GHSA-7wpj-vvmv-pgm8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-7wpj-vvmv-pgm8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-7wpj-vvmv-pgm8/GHSA-7wpj-vvmv-pgm8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-7wpj-vvmv-pgm8
- Aliases
- Published
- 2026-07-28T14:44:01Z
- Modified
- 2026-07-28T15:00:40.066098681Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- @wakaru/cli arbitrary file write during bundle unpack
- Details
-
Impact
@wakaru/cliis vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with--unpack.Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as
....//, could be transformed into../after sanitization. This allowed the final output path to escape the intended output directory.An attacker who can cause a user to run
wakaru --unpackon a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution.Affected versions:
>=1.0.0 <1.4.0.Patches
The issue has been patched in
@wakaru/cli@1.4.0.Users should upgrade to:
npm install @wakaru/cli@latestor specifically:
npm install @wakaru/cli@1.4.0Workarounds
Do not run
wakaru --unpackon untrusted or unknown bundles with affected versions.If upgrading immediately is not possible, avoid using `--unpack on files that may be attacker-controlled.
- Database specific
{ "nvd_published_at": null, "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2026-07-28T14:44:01Z", "cwe_ids": [ "CWE-22" ] }- References
Affected packages
npm / @wakaru/cli
Package
- Name
- @wakaru/cli
- View open source insights on deps.dev
- Purl
- pkg:npm/%40wakaru/cli