{"id":"CVE-2026-54545","sourceIdentifier":"security-advisories@github.com","published":"2026-07-28T16:18:59.327","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0."},{"lang":"es","value":"wakaru es un conjunto de herramientas de descompilación y desminificación de JavaScript. Desde la versión 1.0.0 hasta la 1.4.0, @wakaru/cli sanea los nombres de archivo de módulos controlados por el paquete solo una vez antes de escribir los módulos extraídos, de modo que un nombre de archivo manipulado que contiene secuencias de recorrido superpuestas como .... / / se colapsa a .. /  después del saneamiento y permite que la ruta de salida final escape del directorio de salida seleccionado, permitiendo a un atacante que puede hacer que un usuario ejecute wakaru --unpack en un paquete malicioso escribir archivos fuera de ese directorio y, dependiendo de la ruta de destino y el entorno, potencialmente lograr la ejecución de código. Este problema está solucionado en @wakaru/cli 1.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pionxzh","product":"wakaru","versions":[{"version":">= 1.0.0, < 1.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-28T16:09:11.183514Z","id":"CVE-2026-54545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316","source":"security-advisories@github.com"},{"url":"https://github.com/pionxzh/wakaru/releases/tag/v1.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8","source":"security-advisories@github.com"}]}