CVE-2026-27606: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27606 is an Arbitrary File Write via Path Traversal vulnerability in the Rollup JavaScript module bundler. It affects all versions prior to 2.80.0 (v2.x branch), 3.30.0 (v3.x branch), and 4.59.0 (v4.x branch). The vulnerability was disclosed on February 23, 2026 via a GitHub Security Advisory, with patches released on February 25, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability (CWE-22: Path Traversal) stems from two flawed components in Rollup's core engine. First, the INVALID_CHAR_REGEX in src/utils/sanitizeFileName.ts fails to strip periods (.) and forward/backward slashes (/, \), allowing traversal sequences like ../../ to pass through unsanitized. Second, the writeOutputFile function in src/rollup/rollup.ts uses path.resolve() to combine the output directory with the attacker-controlled filename, which faithfully follows the ../ sequences and resolves a path outside the intended output directory — completing the arbitrary write via fs.writeFile. Exploitation vectors include CLI named inputs (e.g., rollup --input "a/../../pwned.js=main.js" --dir dist), manual chunk aliases, or malicious third-party plugins (GitHub Advisory, Patch Commit v4).

Successful exploitation allows an attacker to write arbitrary files to any location on the host filesystem that the Rollup build process has permissions to access. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files such as ~/.ssh/authorized_keys, .bashrc, or system binaries. The attack requires no authentication or user interaction and is exploitable remotely over a network, posing a significant supply chain risk — malicious third-party plugins or dependencies can silently inject malicious code into a developer's machine during the build phase (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, including a CLI-based demonstration and an automated Python script (exploit.py) that verifies file escape from the output directory. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. The EPSS score is approximately 0.624%, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. No specific threat actor attribution has been made (GitHub Advisory, Feedly).

1. Identify a target: Locate a system running a Rollup build process using a vulnerable version (< 2.80.0, < 3.30.0, or < 4.59.0), particularly CI/CD pipelines or developer workstations that process untrusted input or third-party plugins.
2. Choose an attack vector: Select one of the available vectors — crafted CLI named inputs, malicious chunk aliases in a rollup.config.js, or a malicious npm plugin that manipulates output filenames in the generateBundle hook.
3. Craft the traversal payload: Construct a filename containing path traversal sequences, e.g., a/../../pwned.js or bypass/../../../../../../../Users/victim/Desktop/pwned.js. These sequences pass through the flawed INVALID_CHAR_REGEX sanitizer unmodified.
4. Trigger the build: Execute Rollup with the malicious input, e.g.:

   rollup --input "a/../../pwned.js=main.js" --dir dist

5. Achieve arbitrary file write: Rollup's path.resolve(outputDir, maliciousFileName) resolves to a path outside dist/, and fs.writeFile writes attacker-controlled content to that location.
6. Achieve persistence/RCE: Overwrite a sensitive file such as ~/.bashrc, ~/.ssh/authorized_keys, or a system init script with a malicious payload to establish persistent access or execute arbitrary code on the next login or service restart (GitHub Advisory).

• File System: Unexpected files created outside the configured Rollup output directory (e.g., dist/); modified or newly created files in sensitive locations such as ~/.ssh/authorized_keys, ~/.bashrc, ~/.profile, or system configuration directories; files with names matching traversal patterns like ../ in build logs.
• Logs: Rollup build logs or CI/CD pipeline output showing filenames containing .. segments or absolute paths; error messages with code FILE_NAME_OUTSIDE_OUTPUT_DIRECTORY (in patched versions, indicating an attempted exploit); unexpected build failures or file permission errors during the write phase.
• Process: Unusual processes spawned after a Rollup build completes (e.g., reverse shells, unexpected network connections); Node.js processes writing files to directories outside the project workspace.
• Network: Outbound connections from the build host to unknown external IPs shortly after a Rollup build, potentially indicating post-exploitation activity (GitHub Advisory).

Upgrade Rollup to the patched versions immediately: v2.80.0 (for v2.x users), v3.30.0 (for v3.x users), or v4.59.0 (for v4.x users), all released on February 25, 2026. The fix adds a validateOutputBundleFileNames function that normalizes filenames using join() and throws a FILE_NAME_OUTSIDE_OUTPUT_DIRECTORY error if any output path resolves outside the output directory. As interim mitigations, restrict access to Rollup build processes, avoid running builds against untrusted repositories or plugins, and apply least-privilege principles to the filesystem permissions of the build process account. IBM has also released patches for affected products including watsonx Orchestrate, IBM Bob, IBM DevOps Test UI, and Cloudera Data Platform Private Cloud Base (GitHub Advisory, IBM Advisory, Patch Commit v4).

The vulnerability was reported by security researcher viralvaghela and published by Rollup maintainer lukastaegert via GitHub Security Advisories on February 23, 2026. Red Hat assigned the CVE and rated it as having a CVSS v3.1 score of 9.8 (Critical). The vulnerability received coverage in vulnerability tracking platforms including Tenable Nessus (multiple plugin IDs: 300045, 303785, 303779, 312090, 312098) and Qualys. Community discussion was noted on Mastodon and security digest sites. The broader ecosystem impact is reflected in downstream advisories from IBM, SUSE, Red Hat, and OpenSUSE, indicating significant supply chain reach (Red Hat CVE, GitHub Advisory).