Dependency 'rollup' vulnerability: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

[sacru2red]

ref: #3354

workbox/packages/workbox-build/package.json

Line 42 in c77dceb

"rollup": "^2.43.1",

[westonruter]

Please elaborate.

[erlichmen]

I'll try to add:

The version of rollup is quite old and has CVE-2024-47068, all sort of projects that uses workbox are affected by it (we got here by using docusaurus).

github depenbot gives this an 8.3 which is quite high.