Packages / rollup / Security

HighVulnerabilityGHSA-gcx4-mw62-g8wmPublished 23 Sept 2024

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Affected releases · rollup

  • 4.x4.0.0 – 4.22.3Fixed in 4.22.4
  • 3.x3.0.0 – 3.29.4Fixed in 3.29.5
  • 2.x2.0.0 – 2.79.1Fixed in 2.79.2
  • 1.x and older0.1.0 – 1.32.1No fix, no longer updated

On 4.x, the newest line:

npm install rollup@4.22.4

  1. Affected

    0.1.0 – 2.79.1

    609 releases

  2. Fixed

    2.79.2 – 2.80.0

    2 releases

  3. Affected

    3.0.0 – 3.29.4

    81 releases

  4. Fixed

    3.29.5 – 3.30.0

    2 releases

  5. Affected

    4.0.0 – 4.22.3

    62 releases

  6. Fixed

    4.22.4 – 4.64.12

    123 releases, latest

879 stable releases of rollup, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.