{"schemaVersion":3,"id":"CVE-2026-27606","aliases":["UBUNTU-CVE-2026-27606","DEBIAN-CVE-2026-27606","CGA-2vqm-r36r-68gf","CGA-3m46-gg5w-j2h7","CGA-4rp6-rp45-96fq","CGA-73x3-h643-fgxm","CGA-cfqx-gg65-6gw5","CGA-f77r-9v8p-8qw5","CGA-hj2x-h2vx-9v9w","CGA-hrhc-hw8w-hp3q","CGA-j8c7-g59c-rcmj","CGA-j999-fqg4-372r","CGA-v92m-22pm-jrpj","CGA-w265-x95w-2hxx","CGA-wg93-r73r-5gfm","CGA-x4vh-4xcf-6v8p","GHSA-mw96-cpmx-2vgc","openSUSE-SU-2026:10263-1","CGA-22r2-9779-9gv9","CGA-22wf-283q-w7qc","CGA-25ph-gp3q-g4h4","CGA-26mq-8hrr-wvj8","CGA-2jv8-hf33-jwcj","CGA-3m2p-2rcg-4fjm","CGA-45cq-m6jf-vqhw","CGA-48mr-37pq-qh96","CGA-4g5w-75fq-722g","CGA-4hhv-c2jr-r7v6","CGA-529f-9pxw-h37x","CGA-5843-495x-w3ff","CGA-68fq-fqh5-m8r8","CGA-69pq-5pjq-xrx9","CGA-6p3c-mmgq-wqh2","CGA-6q4m-68jv-3mh5","CGA-6x27-c4cm-2cf6","CGA-6x4c-fr5c-h4v7","CGA-6xf2-qmfg-8x5v","CGA-773c-9c4g-qwgq","CGA-7pmx-wm5h-xg2g","CGA-94m2-wwp8-mqhp","CGA-9h5q-36rj-gq48","CGA-9hcq-g2xm-2p6h","CGA-9rcf-2mph-g4rv","CGA-9w65-fx4m-x2rf","CGA-c3hm-f72v-qffh","CGA-c76c-8338-99xr","CGA-fxvc-qmcp-2rcv","CGA-g2g2-j8wg-764m","CGA-g55x-vvx6-66xh","CGA-g8j8-934h-v85h","CGA-gjg2-q7gf-965w","CGA-gx24-rjgh-8f3x","CGA-h8g5-hx43-hw3r","CGA-h9h2-qjhj-wxq4","CGA-hhrr-4hrg-2923","CGA-hpj2-fmw9-4hvc","CGA-hrfx-rh5c-62ph","CGA-j4wh-5fmc-9mvx","CGA-mg42-wjc9-m4cw","CGA-mqrf-2868-r32m","CGA-mxwq-7qj4-7vjh","CGA-p789-5cv8-wpr4","CGA-pv9f-jw72-mc6w","CGA-pw7f-cqx4-cw5v","CGA-q7qx-57v9-jrmm","CGA-qm77-crf2-799p","CGA-r579-wf8h-vg8p","CGA-r732-r9vp-3782","CGA-vhq9-v3w8-fqx3","CGA-vrr4-2jv2-jm47","CGA-vx3x-4rwf-jc64","CGA-w33w-ch3h-rv75","CGA-w537-7735-fwjf","CGA-wg5c-fvmv-8gvr","CGA-wpvx-8p5g-wjpc","CGA-x859-pg6p-x87h"],"status":"published","duplicateOf":null,"title":null,"description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","dates":{"published":"2026-02-25T02:08:06.682Z","modified":"2026-09-10T12:05:04.070Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0158,"percentile":0.75163,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.1250000000000001,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01455},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0158,"percentile":0.75163}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01455,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01545,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0158,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0158,"percentile":0.75163}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_ROLLUP_ROLLUP","name":"Rollup","source":"github","url":"https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.11","name":"arangodb-3.11","label":"arangodb-3.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.11","purlType":"apk","versions":[{"text":"< 3.11.14.5-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.11.14.5-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"arangodb-3.12","name":"arangodb-3.12","label":"arangodb-3.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.12","purlType":"apk","versions":[{"text":"< 3.12.9.4-r23","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.9.4-r23","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2","name":"langfuse-2","label":"langfuse-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2","purlType":"apk","versions":[{"text":"< 2.95.12-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r12","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.155.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.155.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2","name":"langfuse-fips-2","label":"langfuse-fips-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2","purlType":"apk","versions":[{"text":"< 2.95.12-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.155.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.155.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152","name":"langfuse-fips-3.152","label":"langfuse-fips-3.152","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.6-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 33.0.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.6-r2 | < 33.0.6-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vite","name":"vite","label":"vite","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vite","purlType":"apk","versions":[{"text":"< 8.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-21","name":"vitess-21","label":"vitess-21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-21","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"< 22.0.4-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 22.0.4-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.3-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.155.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.155.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.155.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.6-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 33.0.6-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.6-r2 | < 33.0.6-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vite","name":"vite","label":"vite","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vite","purlType":"apk","versions":[{"text":"< 8.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.0.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.3-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"node-rollup","name":"node-rollup","label":"node-rollup","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-rollup","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.30.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.30.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-rollup","name":"node-rollup","label":"node-rollup","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-rollup","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"rollup","name":"rollup","label":"rollup","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/rollup","purlType":"npm","versions":[{"text":"< 2.80.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, < 3.30.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.0.0, < 4.59.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.80.0 | ≥ 3.0.0, < 3.30.0 | ≥ 4.0.0, < 4.59.0","eol":null,"hubHref":null},{"vendor":"rollup","product":"rollup","name":"rollup","label":"rollup","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.80.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, < 3.30.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.0.0, < 4.59.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.80.0 | ≥ 3.0.0, < 3.30.0 | ≥ 4.0.0, < 4.59.0","eol":null,"hubHref":"/vendor/rollup/rollup"},{"vendor":"rollupjs","product":"rollup","name":"rollup","label":"rollup","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.80.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, < 3.30.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.0.0, < 4.59.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.80.0 | ≥ 3.0.0, < 3.30.0 | ≥ 4.0.0, < 4.59.0","eol":null,"hubHref":"/vendor/rollupjs/rollup"},{"vendor":"opensuse","product":"heroic-games-launcher&distro=openSUSE Tumbleweed","name":"heroic-games-launcher","label":"heroic-games-launcher&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/heroic-games-launcher&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.20.0-2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.0-2.1","eol":null,"hubHref":null}],"affectedCount":43,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc","label":"github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2","label":"github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e","label":"github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3","label":"github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://github.com/rollup/rollup/releases/tag/v2.80.0","label":"github.com/rollup/rollup/releases/tag/v2.80.0","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Product"]},{"url":"https://github.com/rollup/rollup/releases/tag/v3.30.0","label":"github.com/rollup/rollup/releases/tag/v3.30.0","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Product"]},{"url":"https://github.com/rollup/rollup/releases/tag/v4.59.0","label":"github.com/rollup/rollup/releases/tag/v4.59.0","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Product"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27606","label":"access.redhat.com/security/cve/CVE-2026-27606","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442530","label":"bugzilla.redhat.com/show_bug.cgi?id=2442530","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13512","label":"access.redhat.com/errata/RHSA-2026:13512","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13508","label":"access.redhat.com/errata/RHSA-2026:13508","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","label":"access.redhat.com/errata/RHSA-2026:13545","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6174","label":"access.redhat.com/errata/RHSA-2026:6174","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","label":"access.redhat.com/errata/RHSA-2026:6802","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","label":"access.redhat.com/errata/RHSA-2026:10175","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8483","label":"access.redhat.com/errata/RHSA-2026:8483","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5132","label":"access.redhat.com/errata/RHSA-2026:5132","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5665","label":"access.redhat.com/errata/RHSA-2026:5665","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5649","label":"access.redhat.com/errata/RHSA-2026:5649","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27606","label":"ubuntu.com/security/CVE-2026-27606","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27606","label":"www.cve.org/CVERecord?id=CVE-2026-27606","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27606","label":"security-tracker.debian.org/tracker/CVE-2026-27606","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27606.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27606.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27606","label":"nvd.nist.gov/vuln/detail/CVE-2026-27606","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/rollup/rollup","label":"github.com/rollup/rollup","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","label":"www.suse.com/security/cve/CVE-2026-27606","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11126-1","RHSA-2026:13508","RHSA-2026:13512","SUSE-SU-2026:1013-1","SUSE-SU-2026:1148-1","SUSE-SU-2026:1524-1","SUSE-SU-2026:2363-1"],"duplicates":[],"related":["CGA-554Q-W736-PV9Q","OPENSUSE-SU-2026:11126-1","SUSE-SU-2026:1013-1","SUSE-SU-2026:1148-1","SUSE-SU-2026:1524-1","SUSE-SU-2026:2363-1"]},"timeline":[{"kind":"published","date":"2026-02-25T02:08:06.682Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-10T12:05:04.070Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T08:28:51.585Z","stale":false,"partial":false}}