CVE-2026-54545: Wakaru CLI Path Traversal Vulnerability

CVE-2026-54545 Overview

CVE-2026-54545 is a path traversal vulnerability [CWE-22] in @wakaru/cli, the command-line component of the wakaru JavaScript decompiler and unminifier toolkit. Versions from 1.0.0 up to (but not including) 1.4.0 sanitize bundle-controlled module filenames only once before writing extracted modules to disk. A crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after that single pass, allowing the final output path to escape the selected output directory. An attacker who convinces a user to run wakaru --unpack on a malicious bundle can write files outside the intended directory. Depending on the target path and environment, this may lead to code execution.

Critical Impact

A malicious JavaScript bundle can force @wakaru/cli to write attacker-controlled files anywhere the user has write permissions, potentially achieving code execution on the developer workstation.

Affected Products

• @wakaru/cli versions 1.0.0 through 1.3.x
• wakaru JavaScript decompiler and unminifier toolkit (CLI component)
• Fixed in @wakaru/cli 1.4.0

Discovery Timeline

• 2026-07-28 - CVE-2026-54545 published to NVD
• 2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54545

Vulnerability Analysis

The flaw is a classic single-pass sanitization bypass. The pre-patch code in crates/core/src/unpacker/esbuild.rs used trim_start_matches("../") to strip leading traversal segments from bundler-provided module paths. Because trim_start_matches performs a single replacement pass, an input like ....//module.js becomes ../module.js after sanitization rather than a safe relative path. The resulting string is then joined with the user-specified output directory and passed to a file write, so the write escapes the intended sandbox.

Exploitation requires user interaction: the victim must run wakaru --unpack against a bundle that the attacker controls or has tampered with. Because writes occur with the privileges of the invoking user, an attacker can overwrite shell profile files, editor configurations, or scripts in PATH to gain code execution on subsequent user activity.

Root Cause

The root cause is replacement-based sanitization on a string that can contain overlapping malicious patterns. Stripping only leading ../ segments does not account for sequences that produce new traversal tokens after the strip completes.

Attack Vector

The attack vector is local and requires user interaction. An attacker publishes or delivers a JavaScript bundle whose internal module metadata includes filenames with overlapping traversal sequences. When the victim unpacks the bundle with the vulnerable CLI, output files land outside the chosen directory.

// Pre-patch (vulnerable) logic — crates/core/src/unpacker/esbuild.rs
         .trim_start_matches("webpack://")
         .trim_start_matches("webpack:///")
         .trim_start_matches('/');
-    // Strip leading `../` segments so the path doesn't escape the output directory.
-    let s = s.trim_start_matches("../");
-    if s.is_empty() {
-        "module.js".to_string()
-    } else {
-        s.to_string()
-    }
+    crate::unpacker::sanitize_relative_path(s, "module.js")
 }

Source: GitHub commit 1d30383

Detection Methods for CVE-2026-54545

Indicators of Compromise

• Files written outside the directory passed to wakaru --unpack, particularly under user home directories, ~/.bashrc, ~/.zshrc, ~/.config/, or editor plugin directories
• Module paths inside bundles containing overlapping traversal patterns such as ....//, ....\\, or mixed slash sequences
• Unexpected file creation events by the Node.js or wakaru process shortly after a developer runs an unpack operation

Detection Strategies

• Inventory developer workstations and CI runners for installations of @wakaru/cli at versions below 1.4.0 using package manager audits (npm ls @wakaru/cli, pnpm why @wakaru/cli)
• Statically scan JavaScript bundles that will be processed by wakaru for module names containing .., ....//, or backslash traversal tokens before invoking the CLI
• Correlate command-line telemetry showing wakaru --unpack invocations with subsequent file-write events outside the specified output directory

Monitoring Recommendations

• Enable process and file-write auditing on developer endpoints to flag writes by Node-based CLIs to sensitive paths such as shell rc files and directories in PATH
• Alert on installations or updates of @wakaru/cli in software bills of materials (SBOMs) and lockfiles across engineering repositories
• Review CI/CD pipelines that decompile third-party JavaScript for elevated file-system permissions and constrain them where possible

How to Mitigate CVE-2026-54545

Immediate Actions Required

• Upgrade @wakaru/cli to version 1.4.0 or later on all developer workstations and CI systems
• Audit recent wakaru --unpack runs on untrusted bundles and inspect the parent of the intended output directory for unexpected files
• Treat any third-party JavaScript bundle as untrusted input and unpack it inside a sandboxed or containerized environment

Patch Information

The fix is delivered in @wakaru/cli 1.4.0. The patch introduces a component-based sanitizer, sanitize_relative_path, in crates/core/src/unpacker/mod.rs that splits the path on /, then filters out empty segments, ., and .. before rejoining. This approach eliminates the single-pass replacement bypass because traversal tokens cannot re-form after filtering. See the GitHub Security Advisory GHSA-7wpj-vvmv-pgm8 and the v1.4.0 release notes.

// Patched sanitizer — crates/core/src/unpacker/mod.rs
pub(crate) fn sanitize_relative_path(raw: &str, fallback: &str) -> String {
    let normalized = raw.replace('\\', "/");
    let parts: Vec<&str> = normalized
        .split('/')
        .filter(|part| !part.is_empty() && *part != "." && *part != "..")
        .collect();

    if parts.is_empty() {
        fallback.to_string()
    } else {
        parts.join("/")
    }
}

Source: GitHub commit 1d30383

Workarounds

• Run wakaru --unpack only inside a disposable container or virtual machine with no access to host secrets
• Point --output at a dedicated empty directory on a filesystem where the invoking user has no write access to parent directories
• Manually inspect bundle module metadata for suspicious path components before unpacking untrusted input

# Upgrade to the patched release
npm install -g @wakaru/cli@1.4.0

# Verify installed version
wakaru --version

# Run unpack inside an isolated directory
mkdir -p /tmp/wakaru-sandbox && cd /tmp/wakaru-sandbox
wakaru --unpack ./suspicious-bundle.js --output ./out