CVE-2024-47068

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

• CWE-79

• https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162Product
• https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185Product
• https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4Patch
• https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541Patch
• https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wmExploit, Vendor Advisory

Published

Sep 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47062Navidrome is an open source web-based music collection serve…8.8
• CVE-2024-47063Computer Vision Annotation Tool (CVAT) is an interactive vid…6.1
• CVE-2024-47064Computer Vision Annotation Tool (CVAT) is an interactive vid…6.1
• CVE-2024-47065Meshtastic is an open source mesh networking solution. Prior…6.5
• CVE-2024-47066Lobe Chat is an open-source artificial intelligence chat fra…8.8
• CVE-2024-47067AList is a file list program that supports multiple storages…6.1
• CVE-2024-47069Oveleon Cookie Bar is a cookie bar is for the Contao Open So…6.1
• CVE-2024-4707The Materialis Companion plugin for WordPress is vulnerable …5.4
• CVE-2024-47070authentik is an open-source identity provider. A vulnerabili…9
• CVE-2024-47071OSS Endpoint Manager is an endpoint manager module for FreeP…6.8
• CVE-2024-47072XStream is a simple library to serialize objects to XML and …7.5
• CVE-2024-47073DataEase is an open source data visualization analysis tool …9.1