Skip to content
fr Sign in
8.8 High

CVE-2026-27606 Rollup is a module bundler for JavaScript

Description

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 1777311120 earliest → < 1777311120 1777311120
Red Hat Developer Hub 1.8 1774545605 earliest → < 1774545605 1774545605
Red Hat Developer Hub 1.9 1775140647 earliest → < 1775140647 1775140647
Red Hat OpenShift Dev Spaces 3.27 1776718585 earliest → < 1776718585 1776718585
Red Hat OpenShift Service Mesh 2.6 1776191302 earliest → < 1776191302 1776191302
Red Hat OpenShift Service Mesh 2.6 1773059917 earliest → < 1773059917 1773059917
Show the 25 other branches
Product Affected versions Fixed in
Red Hat Quay 3.1 1773971077 earliest → < 1773971077 1773971077
Red Hat Trusted Artifact Signer 1.3 1773934794 earliest → < 1773934794 1773934794
OpenShift Pipelines Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Build of Podman Desktop - Tech Preview Versions not published
Red Hat Fuse 7 Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat Single Sign-On 7 Versions not published
Self-service automation portal 2 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
rollup 4.0 4.0.0 → < 4.59.0 4.59.0
rollup 3.0 3.0.0 → < 3.30.0 3.30.0
rollup 2.80 earliest → < 2.80.0 2.80.0
Red Hat Quay 3.10 1773971077 earliest → < 1773971077 1773971077

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8

The 100 CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8 →
CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process 6.6 Medium CVE-2026-84720 Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle 6.5 Medium CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust 4.3 Medium CVE-2026-84717 Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates 5.3 Medium
Track this CVE