CVE-2026-54545

설명

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fix...

영향 제품·버전

제품 pionxzh wakaru

영향 버전 pionxzh wakaru >= >= 1.0.0, < 1.4.0

수정 버전 pionxzh wakaru · 수정 버전은 공급사 공식자료 확인 필요

기술 정보

CVSS 벡터 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CWE CWE-22