CVE-2026-54545: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in pionxzh wakaru
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.
AI Analysis
Technical Summary
The vulnerability in @wakaru/cli (versions >=1.0.0 <1.4.0) involves improper limitation of a pathname to a restricted directory (CWE-22). The sanitization of module filenames is insufficient because it only occurs once, allowing crafted filenames with overlapping traversal sequences (e.g., ....//) to collapse into ../ after sanitization. This enables an attacker who can cause a user to run 'wakaru --unpack' on a malicious bundle to write files outside the designated output directory. Depending on the target path and environment, this may lead to code execution. The issue is resolved in @wakaru/cli version 1.4.0.
Potential Impact
An attacker able to induce a user to run 'wakaru --unpack' on a malicious bundle can exploit this vulnerability to write files outside the intended output directory. This arbitrary file write can lead to code execution depending on the environment and target paths. The confidentiality impact is none, but integrity and availability impacts are high due to potential code execution and system compromise.
Mitigation Recommendations
Upgrade to @wakaru/cli version 1.4.0 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the fix is included in version 1.4.0, so updating to this version or newer is recommended.
CVE-2026-54545: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in pionxzh wakaru
Description
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.
CVSS v3.1
Score 7.1high
Affected software
pionxzh
wakaru
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in @wakaru/cli (versions >=1.0.0 <1.4.0) involves improper limitation of a pathname to a restricted directory (CWE-22). The sanitization of module filenames is insufficient because it only occurs once, allowing crafted filenames with overlapping traversal sequences (e.g., ....//) to collapse into ../ after sanitization. This enables an attacker who can cause a user to run 'wakaru --unpack' on a malicious bundle to write files outside the designated output directory. Depending on the target path and environment, this may lead to code execution. The issue is resolved in @wakaru/cli version 1.4.0.
Potential Impact
An attacker able to induce a user to run 'wakaru --unpack' on a malicious bundle can exploit this vulnerability to write files outside the intended output directory. This arbitrary file write can lead to code execution depending on the environment and target paths. The confidentiality impact is none, but integrity and availability impacts are high due to potential code execution and system compromise.
Mitigation Recommendations
Upgrade to @wakaru/cli version 1.4.0 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the fix is included in version 1.4.0, so updating to this version or newer is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T19:04:14.455Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a68ccfd9c2644c7f8d2513e
Added to database: 07/28/2026, 15:38:37 UTC
Last enriched: 07/29/2026, 16:55:35 UTC
Last updated: 09/11/2026, 22:06:34 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.