This vulnerability arises from insufficient filename sanitization in Rollup's core engine, allowing an attacker to embed traversal sequences such as '../' when specifying output filenames through the CLI, manual chunk aliases, or malicious plugins. The flaw permits arbitrary file writes on the host filesystem wherever the build process runs, potentially overwriting critical configuration or executable files. The consequence is persistent remote code execution as the attacker can replace system binaries or scripts.

The issue affects the Rollup JavaScript module bundler used in Node.js environments. Versions earlier than 2.80.0, 3.30.0, and 4.59.0 are vulnerable; those specific releases and any earlier iterations of Rollup 2.x, 3.x, and 4.x contain the flaw. The patched releases are documented in the Rollup changelog and can be retrieved from the official Rollup releases pages.

The CVSS score of 8.8 classifies the vulnerability as high severity. EPSS indicates a very low current exploitation probability (<1%), and it is not listed in the CISA KEV catalogue. Based on the description, it is inferred that any user who can supply input to the Rollup build process can trigger the flaw. Therefore, attackers could supply malicious filenames via the CLI, manual chunk aliases, or malicious plugins to overwrite arbitrary files, enabling remote code execution on the host system.