HIGH 7.1 GitHub
CVE-2026-54545
@wakaru/cli arbitrary file write during bundle unpack
### Impact
`@wakaru/cli` is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with `--unpack`.
Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as `....//`, could be transformed into `../` after sanitization. This allowed the final output path to escape the intended output directory.
An attacker who can cause a user to run `wakaru --u
Affected Products
- npm/@wakaru/cli >= 1.0.0, < 1.4.0
References
- https://github.com/advisories/GHSA-7wpj-vvmv-pgm8
- https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8
- https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316
- https://github.com/pionxzh/wakaru/releases/tag/v1.4.0
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-07-28 via GitHub. Affected: npm/@wakaru/cli >= 1.0.0, < 1.4.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.