CVE-2026-54545

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54545", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T19:04:14.455Z", "datePublished": "2026-07-28T14:43:45.808Z", "dateUpdated": "2026-07-28T16:09:23.417Z"}, "containers": {"cna": {"title": "@wakaru/cli arbitrary file write during bundle unpack", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8"}, {"name": "https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316", "tags": ["x_refsource_MISC"], "url": "https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316"}, {"name": "https://github.com/pionxzh/wakaru/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/pionxzh/wakaru/releases/tag/v1.4.0"}], "affected": [{"vendor": "pionxzh", "product": "wakaru", "versions": [{"version": ">= 1.0.0, < 1.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T14:44:26.516Z"}, "descriptions": [{"lang": "en", "value": "wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0."}], "source": {"advisory": "GHSA-7wpj-vvmv-pgm8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T16:09:11.183514Z", "id": "CVE-2026-54545", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T16:09:23.417Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54545", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T16:09:11.183514Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T16:09:19.972Z"}}], "cna": {"title": "@wakaru/cli arbitrary file write during bundle unpack", "source": {"advisory": "GHSA-7wpj-vvmv-pgm8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "pionxzh", "product": "wakaru", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.4.0"}]}], "references": [{"url": "https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8", "name": "https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316", "name": "https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pionxzh/wakaru/releases/tag/v1.4.0", "name": "https://github.com/pionxzh/wakaru/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-28T14:44:26.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54545", "state": "PUBLISHED", "dateUpdated": "2026-07-28T16:09:23.417Z", "dateReserved": "2026-06-15T19:04:14.455Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-28T14:43:45.808Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wakaru", "vendor": "pionxzh", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.4.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0."}, {"lang": "es", "value": "wakaru es un conjunto de herramientas de descompilaci\u00f3n y desminificaci\u00f3n de JavaScript. Desde la versi\u00f3n 1.0.0 hasta la 1.4.0, @wakaru/cli sanea los nombres de archivo de m\u00f3dulos controlados por el paquete solo una vez antes de escribir los m\u00f3dulos extra\u00eddos, de modo que un nombre de archivo manipulado que contiene secuencias de recorrido superpuestas como .... / / se colapsa a .. / despu\u00e9s del saneamiento y permite que la ruta de salida final escape del directorio de salida seleccionado, permitiendo a un atacante que puede hacer que un usuario ejecute wakaru --unpack en un paquete malicioso escribir archivos fuera de ese directorio y, dependiendo de la ruta de destino y el entorno, potencialmente lograr la ejecuci\u00f3n de c\u00f3digo. Este problema est\u00e1 solucionado en @wakaru/cli 1.4.0."}], "id": "CVE-2026-54545", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54545", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T16:09:11.183514Z", "version": "2.0.3"}}]}, "published": "2026-07-28T16:18:59.327", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768786b8ada2f1b0945de13c316"}, {"source": "security-advisories@github.com", "url": "https://github.com/pionxzh/wakaru/releases/tag/v1.4.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/pionxzh/wakaru/security/advisories/GHSA-7wpj-vvmv-pgm8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "wakaru", "source": "cna", "vendor": "pionxzh"}, "product": "wakaru", "vendor": "pionxzh"}], "created": "2026-07-28T20:34:29.021971+00:00", "updated": "2026-08-04T13:00:11.583369+00:00", "vendors": ["pionxzh", "pionxzh$PRODUCT$wakaru"]}