CVE-2024-47068

What it actually does

Rollup-generated browser bundles in cjs, umd, or iife formats can contain a DOM clobbering gadget when code uses import.meta.url or when plugins emit assets and reference them from generated code. The vulnerable output may trust document.currentScript or related DOM-derived values as the base URL for resolving emitted assets. If attacker-controlled, scriptless HTML can define a named element that clobbers the expected DOM property, the bundle may resolve asset URLs relative to an attacker-controlled src value. Depending on how the resolved asset is used, this can lead to cross-site scripting, attacker-controlled resource loading, or execution of attacker-supplied JavaScript in the page context.

Why it matters to the business

Applications built with affected Rollup output can expose users to browser-side compromise if the same page also renders attacker-controlled HTML. Successful exploitation can allow account takeover actions within the victim's browser session, theft of page-accessible data, fraudulent transactions, or manipulation of application content. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, but it has been public since 2024-09-23 and should be addressed during normal dependency and build-pipeline maintenance, especially for applications that render user-generated HTML or embed third-party content.

How an attack unfolds

An attacker first identifies a web page that serves JavaScript bundled by a vulnerable Rollup version and where the bundle uses import.meta.url or references Rollup-emitted assets from cjs, umd, or iife output. The attacker then finds an input path that allows scriptless HTML injection, such as a rendered profile field, comment, CMS block, markdown output, or other unsanitized HTML area. Instead of injecting a script tag, the attacker injects an element such as an img tag with a name attribute that collides with a DOM property used by the generated Rollup helper, commonly document.currentScript. When the vulnerable bundle executes, the browser's named-element behavior can cause the helper to read attacker-controlled element properties, such as src, and use them as the base URL for asset resolution. If the application subsequently loads or executes the resolved resource, for example as a script-like asset, worker, dynamic resource, or trusted application asset, the attacker can cause code execution in the victim's browser context.

How to fix it

Upgrade Rollup to a release that includes the upstream fix, or build from a source revision containing commit dfd233d3a9feb18aa69b49b6c1da0248a4f1c6e3. Rebuild and redeploy all browser bundles produced with affected Rollup versions; upgrading the build dependency alone is not sufficient if previously generated vulnerable assets remain deployed. Prioritize applications that output cjs, umd, or iife bundles and use import.meta.url, new URL(..., import.meta.url), or plugins that emit and reference asset files from code. As defense in depth, sanitize or strip attacker-controlled name and id attributes from rendered HTML where they are not required, prevent untrusted HTML from rendering on pages that load privileged application bundles, enforce a restrictive Content Security Policy with script-src and worker-src limited to trusted origins, and monitor for unexpected external asset loads.

How to confirm the fix worked

Confirm that build manifests, lockfiles, and dependency inventory show a Rollup version or source commit containing dfd233d3a9feb18aa69b49b6c1da0248a4f1c6e3 or a later fixed release. Rebuild production bundles and verify deployed artifacts were regenerated after the upgrade. Inspect generated cjs, umd, and iife JavaScript for import.meta.url replacement code that reads document.currentScript without validating that the resolved element is actually a script element. Test representative pages by injecting benign scriptless HTML such as an img element with name="currentScript" and a controlled src value in a non-production environment, then verify that application asset URLs are not resolved relative to that controlled URL. Validate that CSP blocks untrusted script, worker, and connect destinations and that CSP reporting is enabled where practical.

Typical attack path

1. Identify an application page serving Rollup-generated cjs, umd, or iife browser bundles that reference import.meta.url or emitted assets.
2. Find a feature that renders attacker-controlled HTML on the same page before or during execution of the affected bundle.
3. Inject scriptless HTML with a clobbering name attribute, such as a named img element, and an attacker-controlled src/base URL.
4. Wait for a victim to load the page so the vulnerable Rollup-generated helper resolves asset URLs using the clobbered DOM value.
5. Serve attacker-controlled content at the resolved URL path expected by the bundle.
6. Leverage the loaded attacker-controlled asset to execute JavaScript or manipulate application behavior in the victim's browser session.

How to detect it

Look for both prerequisites and exploitation artifacts. In source and deployed bundles, identify generated JavaScript that references document.currentScript, import.meta.url-derived URL construction, or Rollup-emitted asset paths in cjs, umd, or iife output. In application, WAF, CDN, and reverse-proxy logs, search for submitted or rendered HTML containing name="currentScript", name='currentScript', or name=currentScript, particularly on img, form, embed, object, image, or anchor-like elements. In browser telemetry, CSP reports, CDN logs, DNS logs, and outbound proxy logs, look for application pages loading expected bundle asset filenames from unexpected external origins. Review CSP violation reports for blocked script-src, worker-src, child-src, or connect-src destinations that include asset paths normally served from the application origin. For forensic review, correlate suspicious HTML submissions with subsequent victim page loads and network requests to attacker-controlled domains using emitted asset filenames or paths. There are no widely reported named threat actors or campaigns for this CVE in the provided data.

• name="currentScript"
• name='currentScript'
• name=currentScript
• <img name="currentScript"
• <img name='currentScript'
• <img name=currentScript
• document.currentScript
• import.meta.url
• new URL(
• _documentCurrentScript
• script-src
• worker-src
• blocked-uri

What your security team should do

• Inventory applications and packages that use Rollup to produce browser-facing cjs, umd, or iife bundles.
• Prioritize review of applications that render user-generated HTML, CMS content, markdown, rich text, comments, or third-party embedded content on pages that load Rollup bundles.
• Upgrade Rollup to a fixed release or source revision containing dfd233d3a9feb18aa69b49b6c1da0248a4f1c6e3, then rebuild and redeploy generated assets.
• Search deployed JavaScript artifacts for vulnerable helper patterns involving document.currentScript and import.meta.url-derived asset resolution.
• Harden HTML sanitization rules to block or rewrite dangerous name and id attributes that can clobber DOM properties, especially currentScript.
• Deploy or tighten CSP to restrict script-src, worker-src, child-src, img-src, font-src, and connect-src to expected origins, and collect CSP violation reports.
• Review web, CDN, proxy, RUM, and CSP logs for evidence of unexpected asset loads to untrusted domains or requests containing DOM-clobbering payloads.
• Because this is not KEV and has low EPSS, treat it as a dependency hygiene and exposed-surface reduction priority unless public-facing applications permit untrusted HTML, in which case accelerate remediation.