DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Description

We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g.

Recommendation

Update the rollup package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.79.2

  >= 3.0.0, < 3.29.5

  >= 4.0.0, < 4.22.4**

• Patched version(s): **2.79.2

  3.29.5

  4.22.4**

References

• GHSA-gcx4-mw62-g8wm
• CVE-2024-47068
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS - CVE-2024-45812
• DOM Clobbering Gadget found in astro's client-side router that leads to XSS - CVE-2024-47885
• Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - CVE-2024-43788
• DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS - Vulnerability

Tags:

npm

rollup