CVE-2026-27606

CVE-2026-27606 describes a critical path traversal vulnerability in the Rollup JavaScript module bundler, affecting versions prior to 2.80.0, 3.30.0, and 4.59.0. This flaw allows attackers to control output filenames, using traversal sequences to write arbitrary files anywhere on the host filesystem with the build process's permissions. With a CVSS score of 9.8 (Critical), the vulnerability has a low attack complexity and no user interaction required, potentially leading to persistent Remote Code Execution (RCE) by overwriting critical system files. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, including a detailed article on Dev.to.