CVE-2026-54545 is a high-severity vulnerability affecting @wakaru/cli versions >= 1.0.0, < 1.4.0, specifically in its bundle unpacking functionality. An attacker can cause arbitrary file write when unpacking a crafted JavaScript bundle using the --unpack option due to sanitizing bundle-controlled module filenames before writing extracted modules to the output directory. This allows an attacker-controlled final output path to escape the intended output directory and potentially lead to code execution. The vulnerability affects versions prior to 1.4.0 of @wakaru/cli, with a CVSS score of 7.1, indicating a high business impact due to its potential for code execution. The flaw type is CWE-22, an improper input validation issue that allows path traversal attacks. The attack vector is local, as the vulnerability requires user interaction and can be exploited by running wakaru --unpack on a malicious bundle.
We recommend you to update @wakaru/cli to version 1.4.0.[/subscribe_to_unlock_form]
CVE-2026-54545 is a high-severity vulnerability affecting @wakaru/cli versions >= 1.0.0, < 1.4.0, specifically in its bundle unpacking functionality. An attacker can cause arbitrary file write when unpacking a crafted JavaScript bundle using the --unpack option due to sanitizing bundle-controlled module filenames before writing extracted modules to the output directory. This allows an attacker-controlled final output path to escape the intended output directory and potentially lead to code execution. The vulnerability affects versions prior to 1.4.0 of @wakaru/cli, with a CVSS score of 7.1, indicating a high business impact due to its potential for code execution. The flaw type is CWE-22, an improper input validation issue that allows path traversal attacks. The attack vector is local, as the vulnerability requires user interaction and can be exploited by running wakaru --unpack on a malicious bundle.
We recommend you to update @wakaru/cli to version 1.4.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]