Directory traversal in rollup-plugin-server

Description

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.7.0

References

• GHSA-vr98-27qj-3c8q
• snyk.io
• CVE-2020-7686
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• static-server Path Traversal vulnerability - CVE-2023-26152
• chromedriver Downloads Resources over HTTP - CVE-2016-10579
• Denial of service in http-proxy-middleware - CVE-2024-21536
• parse is vulnerable to prototype pollution - CVE-2025-57324

Tags:

npm

rollup-plugin-server