CVE-2026-54545— Pionxzh Wakaru 路径遍历漏洞

@wakaru/cli arbitrary file write during bundle unpack

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

对路径名的限制不恰当(路径遍历)

Pionxzh Wakaru 路径遍历漏洞

Pionxzh Wakaru是Pionxzh个人开发者开源的一个代码反混淆分析工具。 Pionxzh Wakaru 1.0.0版本至1.4.0之前版本存在路径遍历漏洞，该漏洞源于@wakaru/cli仅对包控制的模块文件名进行一次清理，导致包含重叠遍历序列的特制文件名（例如....//）在清理后变为../，使得最终输出路径逃逸到选定目录之外，攻击者可通过诱导用户对恶意包运行wakaru --unpack在目录外写入文件，并根据目标路径和环境可能导致代码执行。

N/A

N/A