GHSA-mw96-cpmx-2vgc
NoneCVSS
—
EPSS
—
Published
Feb 25, 2026
CISA due date
—
The record
Rollup 4 has Arbitrary File Write via Path Traversal
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | rollup | 0 | 2.80.0 |
| npm | rollup | 3.0.0 | 3.30.0 |
| npm | rollup | 4.0.0 | 4.59.0 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r12 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r12 |
| Chainguard | langfuse-3 | 0 | 3.155.1-r3 |
| Chainguard | langfuse-3-worker | 0 | 3.155.1-r3 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r15 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r15 |
| Chainguard | langfuse-fips-3 | 0 | 3.155.1-r3 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.155.1-r3 |
| Chainguard | librechat | 0 | 0.8.2-r6 |
| Chainguard | vitess-22 | 0 | 22.0.4-r2 |
| Chainguard | vitess-23 | 0 | 23.0.3-r2 |
| Wolfi | langfuse-3 | 0 | 3.155.1-r3 |
| Wolfi | langfuse-3-worker | 0 | 3.155.1-r3 |
| Wolfi | vitess-22 | 0 | 22.0.4-r2 |
| Wolfi | vitess-23 | 0 | 23.0.3-r2 |
Related vulnerabilities
- CVE-2026-27606 Rollup is a module bundler for JavaScript. Same vulnerability
- CVE-2024-47068 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS Also affects rollup
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects langfuse-2
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects langfuse-2
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects langfuse-2
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects langfuse-2
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects langfuse-2
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects langfuse-2