Clobbering vulnerability

### DOM Clobbering Vulnerability in Rollup Dependency Leading to XSS

#### Summary

A DOM Clobbering vulnerability has been identified in `rollup` versions 4.0.0 through < 4.22.4 when bundling scripts using `import.meta.url` or with plugins that emit and reference asset files from code in cjs/umd/iife format. This vulnerability could lead to a Cross-Site Scripting (XSS) attack under certain conditions.

#### Impact

This vulnerability may enable attackers to execute XSS attacks on websites that:
1. Include rollup-bundled files with an output format of cjs, iife, or umd.
2. Use `import.meta` or reference asset files in the above formats.
3. Allow users to inject unsanitized HTML tags, especially `name` or `id` attributes (e.g., an `` tag with the name attribute set to `currentScript`).

The attack leverages the `document.currentScript` property, allowing an attacker to override `currentScript` with a named DOM element, potentially sourcing a malicious script from an attacker-controlled server.

#### PoC

An example scenario and PoC are detailed below:

```html

Rollup XSS Vulnerability Example

```

In this scenario, an attacker can exploit `import.meta.url` and `document.currentScript` in the bundled code to load scripts from an external server.

#### References

- [DOM Clobbering in AMP4Email](https://research.securitum.com/xss-in-amp4email-dom-clobbering/)
- [DOM Clobbering Research Paper](https://scnps.co/papers/sp23_domclob.pdf)

#### Action Needed

Please upgrade `rollup` to version 4.22.4 or later to address this vulnerability.

---