6.1

CVE-2024-47068: rollup Cross-site Scripting

CVSS: 6.1v3.1MediumModified
AliasesUBUNTU-CVE-2024-47068DEBIAN-CVE-2024-47068CGA-hgr9-fcvp-q9v9
Published 23-09-2024Last modified 29-10-2024
Open JSON

Vulnerability summary

CVE-2024-47068 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in rollup. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.74%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 4
OPENSUSE-SU-2025:14663-1CGA-56X5-7M46-9XGJCGA-H8JQ-GMPR-V5FPCGA-W3CQ-R6W2-F8XG

Timeline

  1. 23-09-2024
    PublishedVulnerability first disclosed.
  2. 29-10-2024
    Last modifiedVulnerability information updated.

Description

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

0.00 pp

From 0.74% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Rollup

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard2 products
  • arangodb-3.11< 3.11.14.5-r9
  • vite< 5.4.8-r0
Debian1 product
  • node-rollupAll versions (No fix recorded) | < 3.29.5-1
Npm1 product
  • rollup≥ 3.0.0, < 3.29.5 | ≥ 4.0.0, < 4.22.4 | < 2.79.2
Rollup1 product
  • rollup≥ 3.0.0, < 3.29.5 | ≥ 4.0.0, < 4.22.4 | < 2.79.2
Rollupjs1 product
  • rollup≥ 0.59.0, < 2.79.2 | ≥ 3.0.0, < 3.29.5 | ≥ 4.0.0, < 4.22.4
Ubuntu1 product
  • node-rollupAll versions (No fix recorded)
Wolfi1 product
  • vite< 5.4.8-r0

7 vendors · 8 products

References

11 links
Show all 11 references