{
  "@id": "urn:uuid:299b38ef-11a1-457b-a683-06e9c10e0dc1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T13:41:04.560309+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/rollup@4.22.4",
          "identifiers": {
            "purl": "pkg:npm/rollup@4.22.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:41:04.560309+00:00",
      "status_notes": "Vulnerability CVE-2024-47068 does not affect version 4.22.4 of rollup. not_affected \u2014 Target rollup v4.22.4 is NOT affected by CVE-2024-47068 (DOM Clobbering vulnerability). The upstream fix (adding tagName.toUpperCase() === 'SCRIPT' validation before accessing document.currentScript.src) was shipped in upstream rollup v4.22.4 release. The target is at exactly this version, so the vulnerable pattern is not present. Fix commit e2552c9e9 by upstream maintainer lukastaegert@users.n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-47068"
      },
      "impact_statement": "not_affected \u2014 Target rollup v4.22.4 is NOT affected by CVE-2024-47068 (DOM Clobbering vulnerability). The upstream fix (adding tagName.toUpperCase() === 'SCRIPT' validation before accessing document.currentScript.src) was shipped in upstream rollup v4.22.4 release. The target is at exactly this version, so the vulnerable pattern is not present. Fix commit e2552c9e9 by upstream maintainer lukastaegert@users.n..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/rollup@4.22.4",
          "identifiers": {
            "purl": "pkg:npm/rollup@4.22.4"
          }
        }
      ],
      "timestamp": "2026-11-03T13:21:23.269302+00:00",
      "status_notes": "Vulnerability CVE-2026-27606 affects version 4.22.4 of rollup, and is fixed in 4.22.4-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-27606"
      },
      "action_statement": "Vulnerability CVE-2026-27606 affects version 4.22.4 of rollup, and is fixed in 4.22.4-tuxcare.1."
    }
  ]
}