CVE-2026-54545 in wakaru
Summary
by MITRE • 07/28/2026
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in wakaru cli affects versions 1.0.0 through 1.4.0 where the command line interface fails to properly sanitize module filenames during the unpacking process. This security flaw stems from a single sanitization operation that occurs before writing extracted modules, creating an insufficient defense mechanism against maliciously crafted filenames. The vulnerability specifically manifests when filenames contain overlapping traversal sequences such as ....// which, after sanitization, collapse to ../ patterns that allow path traversal beyond the intended output directory boundaries. This issue represents a classic directory traversal vulnerability that can be exploited through careful crafting of input filenames to bypass security controls.
The technical implementation flaw involves the insufficient handling of path normalization and sanitization routines within the unpacking functionality. When wakaru processes malicious bundles containing specially crafted filenames, the initial sanitization step fails to account for multiple consecutive traversal sequences that would normally be resolved during path resolution but are instead processed as a single sanitization operation. This creates a scenario where the final output path becomes vulnerable to manipulation through overlapping traversal patterns that escape the designated output directory. The vulnerability aligns with CWE-22 Path Traversal and represents a specific implementation weakness in how filename validation is applied during file extraction operations.
The operational impact of this vulnerability extends beyond simple unauthorized file creation, as it can potentially allow attackers to achieve code execution depending on the target environment and directory structure. An attacker who can convince a user to execute wakaru --unpack on a maliciously constructed bundle can write files outside the intended output directory, potentially overwriting critical system files or injecting malicious content into locations where the tool is executed. This exploitation capability can be particularly dangerous in environments where wakaru is used with elevated privileges or in automated build and deployment pipelines where such operations might have broader system implications. The vulnerability essentially provides a pathway for arbitrary file system manipulation through a legitimate tooling function.
Mitigation strategies should focus on implementing robust, multi-stage sanitization routines that properly handle path traversal sequences before any file system operations occur. The fix implemented in version 1.4.0 addresses this by ensuring that filename sanitization occurs multiple times or uses more comprehensive path validation techniques to prevent overlapping traversal patterns from escaping the intended directory boundaries. Security best practices recommend implementing strict input validation, using secure path resolution functions, and maintaining proper sandboxing boundaries for tools that process untrusted input files. Organizations should also consider employing runtime protections such as file system access controls and monitoring mechanisms to detect unauthorized file system modifications during tool execution. This vulnerability demonstrates the critical importance of validating and sanitizing all user-provided input in security-sensitive applications, particularly those involving file system operations and code processing utilities.
The ATT&CK framework categorizes this vulnerability under TA0005 Defense Evasion and TA0004 Privilege Escalation techniques, as it allows attackers to bypass directory restrictions and potentially escalate privileges through file system manipulation. The vulnerability also relates to T1059 Command and Scripting Interpreter where malicious code injection could occur through the arbitrary file writing capability, and T1203 Exploitation for Client Execution if the manipulated files are subsequently executed by the system. This represents a particularly dangerous class of vulnerability in development tools where the security controls may not be as rigorously implemented as in production systems, creating potential attack vectors that can be leveraged by threat actors with access to development environments or users who process untrusted code bundles.