CVE-2026-54545
Impact
@wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack.
Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as ....//, could be transformed into ../ after sanitization. This allowed the final output path to escape the intended output directory.
An attacker who can cause a user to run wakaru --unpack on a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution.
Affected versions: >=1.0.0 <1.4.0.
Patches
The issue has been patched in @wakaru/cli@1.4.0.
Users should upgrade to:
npm install @wakaru/cli@latest
or specifically:
npm install @wakaru/cli@1.4.0
Workarounds
Do not run wakaru --unpack on untrusted or unknown bundles with affected versions.
If upgrading immediately is not possible, avoid using `--unpack on files that may be attacker-controlled.
⚡ Watch CVE-2026-54545
Get an email if CVE-2026-54545 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54545)