Log in Start free

Vulnerability · Published Sep 23, 2024 · Assigned by GitHub_M

CVE-2024-47068DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Medium 6.1

In plain English

A medium-severity cross-site scripting in rollup from rollup. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-rollupno fix listedDEBIAN-CVE-2024-47068
Debian:13node-rollup3.29.5-1DEBIAN-CVE-2024-47068
Debian:14node-rollup3.29.5-1DEBIAN-CVE-2024-47068
Ubuntu:22.04:LTSnode-rollupno fix listedUBUNTU-CVE-2024-47068
Ubuntu:24.04:LTSnode-rollupno fix listedUBUNTU-CVE-2024-47068
Ubuntu:25.10node-rollupno fix listedUBUNTU-CVE-2024-47068
Ubuntu:26.04:LTSnode-rollupno fix listedUBUNTU-CVE-2024-47068
Ubuntu:26.10node-rollupno fix listedUBUNTU-CVE-2024-47068
npmrollup2.79.2GHSA-gcx4-mw62-g8wm
npmrollup4.22.4GHSA-gcx4-mw62-g8wm
npmrollup3.29.5GHSA-gcx4-mw62-g8wm

Affected products (as reported)

VendorProductVersions
rollup rollup >= 3.0.0, < 3.29.5>= 4.0.0, < 4.22.4< 2.79.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References