Packages / rollup / Security

HighVulnerabilityGHSA-mw96-cpmx-2vgcPublished 25 Feb 2026

Rollup 4 has Arbitrary File Write via Path Traversal

Affected releases · rollup

  • 4.x4.0.0 – 4.58.0Fixed in 4.59.0
  • 3.x3.0.0 – 3.29.5Fixed in 3.30.0
  • 2.x2.0.0 – 2.79.2Fixed in 2.80.0
  • 1.x and older0.1.0 – 1.32.1No fix, no longer updated

On 4.x, the newest line:

npm install rollup@4.59.0

  1. Affected

    0.1.0 – 2.79.2

    610 releases

  2. Fixed

    2.80.0

    1 release

  3. Affected

    3.0.0 – 3.29.5

    82 releases

  4. Fixed

    3.30.0

    1 release

  5. Affected

    4.0.0 – 4.58.0

    151 releases

  6. Fixed

    4.59.0 – 4.64.12

    34 releases, latest

879 stable releases of rollup, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.