DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Description

We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g.

Recommendation

Update the rollup package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.79.2

  >= 3.0.0, < 3.29.5

  >= 4.0.0, < 4.22.4**

• Patched version(s): **2.79.2

  3.29.5

  4.22.4**

References

• GHSA-gcx4-mw62-g8wm
• CVE-2024-47068
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485
• react-native-keys insecurely stores encryption cipher and Base64 chunks - CVE-2025-45001
• nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR - CVE-2024-34343
• Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - CVE-2025-27793

Tags:

npm

rollup