{"id":"CVE-2026-54545","state":"PUBLISHED","title":"@wakaru/cli arbitrary file write during bundle unpack","description":"wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.","publishedAt":"2026-07-28T14:43:45.808Z","updatedAt":"2026-07-28T16:09:23.417Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["pionxzh wakaru"],"affected":[{"vendor":"pionxzh","product":"wakaru","versions":[{"version":">= 1.0.0, < 1.4.0","status":"affected"}]}],"references":["https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8","https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316","https://github.com/pionxzh/wakaru/releases/tag/v1.4.0"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/54xxx/CVE-2026-54545.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-54545","state":"PUBLISHED","datePublished":"2026-07-28T14:43:45.808Z","dateUpdated":"2026-07-28T16:09:23.417Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-06-15T19:04:14.455Z"},"containers":{"cna":{"title":"@wakaru/cli arbitrary file write during bundle unpack","descriptions":[{"lang":"en","value":"wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0."}],"affected":[{"vendor":"pionxzh","product":"wakaru","versions":[{"version":">= 1.0.0, < 1.4.0","status":"affected"}]}],"references":[{"url":"https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8","name":"https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316","name":"https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316","tags":["x_refsource_MISC"]},{"url":"https://github.com/pionxzh/wakaru/releases/tag/v1.4.0","name":"https://github.com/pionxzh/wakaru/releases/tag/v1.4.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-07-28T14:44:26.516Z"},"source":{"advisory":"GHSA-7wpj-vvmv-pgm8","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-28T16:09:11.183514Z","id":"CVE-2026-54545","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-28T16:09:23.417Z"}}]}}}