{"id":"CVE-2026-54545","aliases":["GHSA-7wpj-vvmv-pgm8"],"title":"@wakaru/cli arbitrary file write during bundle unpack","summary":"@wakaru/cli arbitrary file write during bundle unpack","severity":"high","cvss":7.1,"cwe":["CWE-22"],"vendor":"wakaru","product":"@wakaru/cli","ecosystem":"npm","affected":["@wakaru/cli >= 1.0.0, < 1.4.0"],"patched":["@wakaru/cli 1.4.0"],"published":"2026-07-28","updated":"2026-07-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7wpj-vvmv-pgm8","references":[{"url":"https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8"},{"url":"https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316"},{"url":"https://github.com/pionxzh/wakaru/releases/tag/v1.4.0"},{"url":"https://github.com/advisories/GHSA-7wpj-vvmv-pgm8"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-28T15:36:57.274Z","epss":0.00149,"epssPercentile":0.04486,"slug":"CVE-2026-54545","body":"## Overview\n\n### Impact\n\n`@wakaru/cli` is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with `--unpack`.\n\nBundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as `....//`, could be transformed into `../` after sanitization. This allowed the final output path to escape the intended output directory.\n\nAn attacker who can cause a user to run `wakaru --unpack` on a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution.\n\nAffected versions: `>=1.0.0 <1.4.0`.\n\n### Patches\n\nThe issue has been patched in `@wakaru/cli@1.4.0`.\n\nUsers should upgrade to:\n\n```sh\nnpm install @wakaru/cli@latest\n```\n\nor specifically:\n```\nnpm install @wakaru/cli@1.4.0\n```\n\n### Workarounds\n\nDo not run `wakaru --unpack` on untrusted or unknown bundles with affected versions.\n\nIf upgrading immediately is not possible, avoid using `--unpack on files that may be attacker-controlled.\n\n## Affected packages\n\n- `@wakaru/cli >= 1.0.0, < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@wakaru/cli 1.4.0`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}