CVE Feed

    Dashboard / CVE / CVE-2024-47068

    CVE-2024-47068

    Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.

    Published:Sep 23, 2024
    Last Modified:Oct 29, 2024
    EPS:Sep 23, 2024
    EPSS Score:0.00058
    CVSS Score:6.1

    Affected Products

    Vendor
    Redhat
    Product
    Openshift Distributed Tracing
    Vendor
    Redhat
    Product
    Rhdh
    Vendor
    Rollup
    Product
    Rollup
    Vendor
    Rollupjs
    Product
    Rollup

    Exploits

    https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm

    Related CVEs

    CVE-2026-62147 (CVSS 6.5) — The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query A…
    CVE-2026-4878 (CVSS 6.7) — A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race…
    CVE-2026-4645 (CVSS 7.5) — Duplicate of CVE-2026-32287…
    CVE-2025-11065 (CVSS 5.3) — A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.…
    CVE-2025-7425 (CVSS 7.8) — A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts interna…
    CVE-2025-5318 (CVSS 5.4) — A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in…
    CVE-2025-6020 (CVSS 7.8) — A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper pr…
    CVE-2025-4673 (CVSS 6.8) — Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sen…
    CVE-2025-5278 (CVSS 4.4) — A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under…
    CVE-2025-5914 (CVSS 7.8) — A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High