CVE-2026-54545: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54545 is a path traversal vulnerability in @wakaru/cli, a JavaScript decompiler and unminifier toolkit, that allows arbitrary file writes outside the intended output directory during bundle unpacking. It affects all versions from 1.0.0 up to (but not including) 1.4.0. The vulnerability was first published on June 5, 2026, and added to the GitHub Advisory Database on July 28, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In affected versions, @wakaru/cli sanitized bundle-controlled module filenames only once before writing extracted modules to the output directory. A crafted filename containing overlapping traversal sequences — such as ....// — would collapse to ../ after a single-pass sanitization, allowing the resolved output path to escape the designated output directory. Exploitation requires an attacker to craft a malicious JavaScript bundle (e.g., a webpack5 bundle with a module key like ....//node_modules/@wakaru/cli/bin/wakaru) and socially engineer a user into running wakaru --unpack against it. The fix in commit 1d30383 replaces substring-based sanitization with component-by-component path parsing, canonical path verification, and symlink escape checks (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to write arbitrary files to locations outside the user-specified output directory, with integrity and availability impacts rated High. Depending on the target path and user environment, this can escalate to code execution — for example, by overwriting executable scripts, configuration files, or Node.js package binaries accessible to the user. Confidentiality impact is rated None, as the vulnerability does not directly expose data, but the ability to plant malicious files creates significant risk for lateral movement or persistence (GitHub Advisory).

1. Craft a malicious bundle: Create a JavaScript bundle (e.g., webpack5 format) with a module key containing overlapping path traversal characters, such as ....//node_modules/@wakaru/cli/bin/wakaru. The module's content should be the attacker's desired payload (e.g., module.exports = "pwned"; or a malicious script).
2. Distribute the bundle: Deliver the malicious bundle to a target user via a repository, download link, or other social engineering vector, presenting it as a legitimate minified JavaScript file to be analyzed.
3. Induce the victim to run wakaru: Convince the victim to run wakaru --unpack -o <output_dir> <malicious_bundle.js> using an affected version (>=1.0.0, <1.4.0).
4. Trigger path traversal: During unpacking, the CLI sanitizes the filename ....//node_modules/@wakaru/cli/bin/wakaru once, collapsing it to ../node_modules/@wakaru/cli/bin/wakaru, which resolves to a path outside the specified output directory.
5. Achieve arbitrary file write: The attacker's payload is written to the resolved path outside the output directory. If the target path is an executable or configuration file, this can lead to code execution on the victim's system (GitHub Advisory, Fix Commit).

• File System: Unexpected or modified files outside the designated wakaru output directory, particularly in paths like node_modules/, ~/.npm/, or other directories accessible to the user running the CLI; files with content inconsistent with legitimate JavaScript modules (e.g., shell commands, unexpected exports).
• Logs: Shell or terminal history showing execution of wakaru --unpack against an unfamiliar or externally sourced bundle file; error messages referencing path traversal or unexpected file write locations from wakaru CLI output.
• Process: Unexpected processes spawned after running wakaru --unpack, particularly if an overwritten executable was subsequently invoked by the user or an automated process.

Upgrade @wakaru/cli to version 1.4.0 or later, which resolves the vulnerability by implementing component-by-component filename sanitization and canonical path verification before any file write (GitHub Release). To upgrade, run npm install @wakaru/cli@latest or npm install @wakaru/cli@1.4.0. As a workaround for users unable to upgrade immediately, do not run wakaru --unpack on untrusted, unknown, or externally sourced bundles (GitHub Advisory).

The vulnerability was discovered and reported by security researcher j4k0xb, credited as the finder in the GitHub advisory. The maintainer (pionxzh) published the advisory and patched the issue in the v1.4.0 release on June 5, 2026, with the advisory added to the GitHub Advisory Database on July 28, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory, GitHub Release).