The issue is related to a DOM Clobbering vulnerability in Rollup when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. This vulnerability can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. The DOM Clobbering gadget can be exploited by an attacker to load scripts from an attacker-controlled server.