FKIE_CVE-2026-54545

Vulnerability from fkie_nvd - Published: 2026-07-28 16:18 - Updated: 2026-10-24 13:10
Severity
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Summary
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.
References
security-advisories@github.comhttps://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316
security-advisories@github.comhttps://github.com/pionxzh/wakaru/releases/tag/v1.4.0
security-advisories@github.comhttps://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "wakaru",
          "vendor": "pionxzh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.4.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0."
    },
    {
      "lang": "es",
      "value": "wakaru es un conjunto de herramientas de descompilaci\u00f3n y desminificaci\u00f3n de JavaScript. Desde la versi\u00f3n 1.0.0 hasta la 1.4.0, @wakaru/cli sanea los nombres de archivo de m\u00f3dulos controlados por el paquete solo una vez antes de escribir los m\u00f3dulos extra\u00eddos, de modo que un nombre de archivo manipulado que contiene secuencias de recorrido superpuestas como .... / / se colapsa a .. /  despu\u00e9s del saneamiento y permite que la ruta de salida final escape del directorio de salida seleccionado, permitiendo a un atacante que puede hacer que un usuario ejecute wakaru --unpack en un paquete malicioso escribir archivos fuera de ese directorio y, dependiendo de la ruta de destino y el entorno, potencialmente lograr la ejecuci\u00f3n de c\u00f3digo. Este problema est\u00e1 solucionado en @wakaru/cli 1.4.0."
    }
  ],
  "id": "CVE-2026-54545",
  "lastModified": "2026-10-24T13:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54545",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-28T16:09:11.183514Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T16:18:59.327",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pionxzh/wakaru/releases/tag/v1.4.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.