CVE-2026-54545
Received Received - Intake

Path Traversal in Wakaru CLI

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54545
EUVD
EUVD-2026-49869

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wakaru cli From 1.0.0 (exc) to 1.4.0 (inc)
wakaru cli From 1.0.0 (inc) to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an arbitrary file write vulnerability in the Wakaru CLI tool affecting versions 1.0.0 to 1.3.9. When running `wakaru --unpack` on a crafted bundle, malicious module filenames containing path traversal sequences like ....// are not properly sanitized. After sanitization, these sequences become ../, allowing an attacker to escape the intended output directory and write files to arbitrary locations on the system.

Detection Guidance

Check if your system has versions of @wakaru/cli between 1.0.0 and 1.3.9 installed by running: npm list @wakaru/cli or npx @wakaru/cli --version. If the version is below 1.4.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to write files outside the intended directory, potentially leading to code execution depending on the environment. This could allow an attacker to overwrite system files, install malware, or gain control of the affected system if the files are executed.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially compromising data integrity and confidentiality. For GDPR, it may violate principles of data protection and security. For HIPAA, it could risk unauthorized access to protected health information, leading to compliance violations and legal consequences.

Mitigation Strategies

Upgrade @wakaru/cli to version 1.4.0 or later using: npm install -g @wakaru/cli@latest or npx @wakaru/cli@latest --help. Avoid running --unpack on untrusted files until upgraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart