CVE-2024-47068 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Attacker can execute arbitrary JavaScript via DOM clobbering in bundled scripts using import.meta properties in specific output formats.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47068?
CVE-2024-47068 is a medium-severity cross-site scripting vulnerability in rollup, published on 23 Sep 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-47068?
6 open source packages ship an affected version, including rollup. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rollup npm | All versions | 2.79.2 |
rollup npm | All versions | 2.79.2 |
rollup npm | From 3.0.0 | 3.29.5 |
rollup npm | From 3.0.0 | 3.29.5 |
rollup npm | From 4.0.0 | 4.22.4 |
rollup npm | From 4.0.0 | 4.22.4 |
Products include Rollupjs Rollup.
How do I fix CVE-2024-47068?
Upgrade rollup to a fixed version for your release line: 2.79.2, 3.29.5 or 4.22.4.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47068 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47068 exists.
Other vulnerabilities in rollup
Sources
Also known as CLSA-2026-1774570949, CLSA-2026-1774830282, CLSA-2026-1775089651, CLSA-2026-1775089653, CLSA-2026-1775089660, CLSA-2026-1784682991 and 5 more.