CVE-2026-54545: wakaru >= 1.0.0, < 1.4.0

Affected technology

wakaru · >= 1.0.0, < 1.4.0
pionxzh

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · User interaction required

What an attacker can do

The source says from 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. Vendor/CNA’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality impact as none; integrity and availability impact as high.