PT-2026-65513 · Npm · @Wakaru/Cli

CVE-2026-54545 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions @wakaru/cli versions 1.0.0 through 1.3.x

Description An arbitrary file write issue exists when unpacking a crafted JavaScript bundle using the --unpack command. The software sanitizes bundle-controlled module filenames only once before writing extracted modules. A crafted filename containing overlapping traversal sequences, such as ....//, collapses to ../ after sanitization, allowing the final output path to escape the selected output directory. This can enable an attacker to write files outside the intended directory, which may lead to code execution depending on the target path and environment.

Recommendations Update @wakaru/cli to version 1.4.0. Avoid running the --unpack command on untrusted or unknown bundles.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-54545

GHSA-7WPJ-VVMV-PGM8

Affected Products

@Wakaru/Cli

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54545 · Security Note
• https://osv.dev/vulnerability/GHSA-7wpj-vvmv-pgm8 · Vendor Advisory
• https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316 · Note
• https://github.com/pionxzh/wakaru · Note
• https://github.com/pionxzh/wakaru/releases/tag/v1.4.0 · Note
• https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8 · Note