CVE-2026-54545

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54545
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54545.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54545
Aliases
Published
2026-07-28T14:43:45Z
Modified
2026-08-12T03:51:28Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
@wakaru/cli arbitrary file write during bundle unpack
Details

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54545.json"
}
References

Affected packages

Git / github.com/pionxzh/wakaru

Affected ranges

Type
GIT
Repo
https://github.com/pionxzh/wakaru
Events
Introduced
398852d84fbcbbf75759128d44619d8bc09e2424
Fixed
1d30383b20a6f768786b8ada2f1b0945de13c316
Fixed
62fee836402487a7581f571dbea41e7cd50532eb
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.4.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54545.json"