Rollup: path traversal lets a build write files anywhere
Rollup's output filename sanitizer left ../ sequences intact, so a crafted input name, chunk alias, or plugin could make a build write files outside its output directory.
- Package
- rollup (npm)
- Affected
- < 2.80.0, 3.0.0 to < 3.30.0, 4.0.0 to < 4.59.0
- Fixed in
- 2.80.0, 3.30.0, 4.59.0
- Weakness
- CWE-22 Path traversal
- Severity
- High, CVSS 4.0 score 8.8
- Advisory
- GHSA-mw96-cpmx-2vgc
Severity
8.8CVSS 4.0
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- None
- Downstream systems
- None
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
What was the issue
Rollup names its output files from values supplied by named inputs, manual chunk aliases, and plugins. Its filename sanitizer did not strip dots or slashes, so ../ sequences survived. The final path was then built with path.resolve against the output directory, which let it climb out of that directory.
Impact
A build could write files anywhere the build process had permission to write. Overwriting files such as shell profiles or SSH configuration could lead to code execution on a developer machine or CI runner, and a malicious plugin or dependency could use the same path to plant code during builds.
Rollup is one of the most widely used JavaScript bundlers, so the fix shipped across all three supported major versions.
What to do
Upgrade to Rollup 2.80.0, 3.30.0, or 4.59.0 or later.
Disclosure timeline
Reported privately to the Rollup maintainers.
Maintainers publish the advisory with patched releases.
Added to the GitHub Advisory Database and NVD.
The takeaway. Sanitize names, then verify the resolved path is still inside the directory you meant to write to. Checking the final path is the step that actually holds.
