CVE-2026-54545 Details
Description
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.
A vulnerability in the Wakaru CLI tool, versions 1.0.0 prior to 1.4.0, allows for arbitrary file writing due to improper sanitization of bundle-controlled module filenames. The vulnerability arises when filenames containing overlapping traversal sequences, such as '....//', are transformed during the sanitization process, potentially escaping the intended output directory. This flaw can be exploited by an attacker to write files outside the designated directory, and depending on the environment and target path, could lead to code execution.
Users should upgrade to Wakaru CLI version 1.4.0 or later. Instructions for upgrading are available on the Wakaru GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316 | [email protected] | Source CodeVendor |
| https://github.com/pionxzh/wakaru/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @wakaru/cli | >= 1.0.0, < 1.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | New CVE Received | [email protected] |
| Jul 28, 2026 | CVE Modified | CISA-ADP |