Skip to content
Fencer Vulns
critical 9.1

CVE-2026-27606 json

Rollup 4 has Arbitrary File Write via Path Traversal

published 2026-02-25 8 mo ago modified 2026-09-10 1 mo ago also GHSA-mw96-cpmx-2vgc , EUVD-2026-8589

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

Patch / fix

  • npm rollup 2.80.0, 3.30.0, 4.59.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260422-2.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260422-2.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.8-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1777311120
  • Red Hat Red Hat Developer Hub 1.8 1774545605
  • Red Hat Red Hat Developer Hub 1.9 1775140647
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 1776718585
  • Red Hat Red Hat OpenShift Service Mesh 2.6 1773059917, 1776191302
  • Red Hat Red Hat Quay 3.10 1773971077
  • Red Hat Red Hat Trusted Artifact Signer 1.3 1773934794
  • node-rollup Debian 14 3.30.0-1

debian advisories DEBIAN-CVE-2026-27606

  • receptor ansible automation platform 2.6 1.6.4-3.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.4-2.el9ap
  • receptorctl ansible automation platform 2.6 1.6.4-3.el10ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.4-2.el9ap
  • python3.12-pyjwt ansible automation platform 2.6, ansible automation platform 2.5 2.12.1-1.el9ap
  • python3.12-pyasn1 ansible automation platform 2.6, ansible automation platform 2.5 0.6.3-1.el9ap
  • python3.12-jwcrypto ansible automation platform 2.6, ansible automation platform 2.5 1.5.7-1.el9ap
  • python3.12-markdown ansible automation platform 2.6, ansible automation platform 2.5 3.10.2-1.el9ap

red hat advisories RHSA-2026:13508RHSA-2026:13512

  • cockpit SLE Micro 5.5 298-150500.3.12.1
  • grafana Multi Linux Manager Tools SLE-15 11.6.14+security01-150002.4.14.1
  • spacecmd Multi Linux Manager Tools SLE-15 5.1.13-150002.3.9.3
  • uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.1.26-150002.3.12.1
  • prometheus-blackbox_exporter Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 0.26.0-150002.3.6.1
  • golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.5.0-150002.3.8.1
  • golang-github-lusitaniae-apache_exporter Multi Linux Manager Tools SLE-15 1.0.10-150002.3.6.1
  • rhnlib Multi Linux Manager Tools Beta SLE-15 5.2.4-159000.4.3.1

suse advisories SUSE-SU-2026:2363-1SUSE-SU-2026:1524-1SUSE-SU-2026:1148-1SUSE-SU-2026:1013-1

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • heroic-games-launcher openSUSE Tumbleweed 2.20.0-2.1

opensuse advisories openSUSE-SU-2026:11126-1openSUSE-SU-2026:10263-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27606 updated cvss 9.1

rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-on-clouds/aoc-azure-aap-installer-rhel9
    affected: workaround, no fix available
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-bootc-rhel10, rhdesktop/rh-podman-desktop-ext-sandbox-rhel10, rhdesktop/rh-podman-desktop-ext-redhat-account-rhel10, rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Fuse 7 io.syndesis-syndesis-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel8
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 org.keycloak-keycloak-parent
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260422-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260422-2.el9ap
    fixed: vendor fix RHSA-2026:13512
show 18 more
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777311120
    fixed: vendor fix RHSA-2026:13545
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-platform-ui 2.6.8-1.el9ap
    fixed: vendor fix RHSA-2026:13508
  • Red Hat Developer Hub 1.8 rhdh 1774545605
    fixed: vendor fix RHSA-2026:6174
  • Red Hat Developer Hub 1.9 rhdh 1775140647
    fixed: vendor fix RHSA-2026:6802
  • Red Hat OpenShift Dev Spaces 3.27 devspaces 1776718585
    fixed: vendor fix RHSA-2026:10175
  • Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh 1773059917, openshift-service-mesh 1776191302
    fixed: vendor fix RHSA-2026:8483
  • Red Hat Quay 3.10 quay 1773971077
    fixed: vendor fix RHSA-2026:5665
  • Red Hat Trusted Artifact Signer 1.3 rhtas 1773934794
    fixed: vendor fix RHSA-2026:5649
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    not affected: vulnerable code not present
  • Red Hat AMQ Broker 7 org.jolokia-jolokia-parent
    not affected: component not present
  • Red Hat Ansible Automation Platform 2 automation-controller, automation-eda-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.4-2.el8ap, yamllint 1.38.0-1.el8ap, receptorctl 1.6.4-2.el8ap, ansible-lint 26.1.1-1.el8ap, ansible-core 2.16.18-1.el8ap, ansible-test 2.16.18-1.el8ap, +43 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +43 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1777410604, ansible-automation-platform 1777410621, ansible-automation-platform-26 1777163004, ansible-automation-platform-26 1777163348, ansible-automation-platform-26 1777163557, ansible-automation-platform-26 1777163594, +23 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +46 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.4-3.el10ap, yamllint 1.38.0-2.el10ap, receptorctl 1.6.4-3.el10ap, ansible-lint 26.1.1-2.el10ap, python-black 26.3.1-2.el10ap, ansible-core 2.16.18-2.el10ap, +7 more
    not affected: vulnerable code not present
  • Red Hat build of OptaPlanner 8 org.optaweb.vehiclerouting-optaweb-vehicle-routing
    not affected: component not present
  • Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-rhel-rhel10 Red Hat Developer Hub 1.8 rhdh 1774544220, rhdh 1774549552 Red Hat Developer Hub 1.9 rhdh 1775140369, rhdh 1775155242
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-selinux Red Hat Enterprise Linux 10 grafana
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/disk-image-cuda-rhel9
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform 8 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.keycloak-keycloak-parent
    not affected: component not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-agent-installer-ui-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Dev Spaces 3.27 devspaces 1776716842, devspaces 1776717247, devspaces 1776718438, devspaces 1776718450, devspaces 1776718480, devspaces 1776743204, +9 more Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh 1773059840, openshift-service-mesh 1776202125
    not affected: vulnerable code not present

2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
8 mo ago

Exploit prediction

1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 4.0 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm rollup
<2.80.0
>=3.0.0, <3.30.0
>=4.0.0, <4.59.0
2.80.0
3.30.0
4.59.0

Affected products

  • rollup rollup
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat AMQ Broker 7
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift distributed tracing 3
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat Self-service automation portal 2

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.