# CVE-2026-27606: node-rollup: Rollup is a module bundler for JavaScript

CVE-2026-27606 is fixed in 8 products on 1 platform, first by DEBIAN-CVE-2026-27606, released February 25, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-27606
- Priority: Urgent
- CVSS: 9.8 (critical)
- EPSS: 0.0165
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 25, 2026

## Description

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | dracut-saltboot opensuse-leap 15.6 | 1.1.0-150000.1.65.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | golang-github-QubitProducts-exporter_exporter opensuse-leap 15.6 | 0.4.0-150000.1.21.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | golang-github-boynux-squid_exporter opensuse-leap 15.6 | 1.13.0-150000.1.12.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | golang-github-lusitaniae-apache_exporter opensuse-leap 15.6 | 1.0.10-150000.1.26.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | golang-github-prometheus-promu opensuse-leap 15.6 | 0.17.0-150000.3.30.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | golang-github-prometheus-promu sles 15.7 | 0.17.0-150000.3.30.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | node-rollup Debian 14 | 3.30.0-1 | [DEBIAN-CVE-2026-27606](https://patchblox.com/security/data/fix/linux/debian-cve-2026-27606.md) | Feb 25, 2026 |
| Linux | prometheus-blackbox_exporter opensuse-leap 15.6 | 0.26.0-150000.1.30.2 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |
| Linux | spacecmd opensuse-leap 15.6 | 5.0.15-150000.3.142.1 | [SUSE-SU-2026:1013-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1013-1.md) | Mar 25, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.