Path traversal in rollup-plugin-serve

Description

Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation.

Recommendation

Update the rollup-plugin-serve package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.2
• Patched version(s): 1.0.2

References

• GHSA-4j46-mp85-mv8c
• vuldb.com
• CVE-2020-7684
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• MJML vulnerable to path traversal - CVE-2020-12827
• Path traversal vulnerability in gatsby-plugin-sharp - CVE-2023-30548
• Path Traversal in socket.io-file - CVE-2020-15779
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

rollup-plugin-serve