@wakaru/cli arbitrary file write during bundle unpack

### Impact `@wakaru/cli` is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with `--unpack`. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as `....//`, could be transformed into `../` after sanitization. This allowed the final output path to escape the intended output directory. An attacker who can cause a user to run `wakaru --unpack` on a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution. Affected versions: `>=1.0.0 <1.4.0`. ### Patches The issue has been patched in `@wakaru/[email protected]`. Users should upgrade to: ```sh npm install @wakaru/cli@latest ``` or specifically: ``` npm install @wakaru/[email protected] ``` ### Workarounds Do not run `wakaru --unpack` on untrusted or unknown bundles with affected versions. If upgrading immediately is not possible, avoid using `--unpack on files that may be attacker-controlled.

Source published

28 Jul 2026 14:44:01 UTC

Source modified

28 Jul 2026 15:11:50 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Publisher rating · HIGH