CyberRota Analysis
AI-GeneratedThe vulnerability affects the @wakaru/cli component of the wakaru JavaScript decompiler toolkit, allowing crafted filenames with overlapping traversal sequences to escape the designated output directory during module extraction. This could enable an attacker to write files outside the intended directory, potentially leading to code execution if the user runs the tool on a malicious bundle. Organizations using versions 1.0.0 to 1.4.0 of wakaru should prioritize upgrading to version 1.4.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitization and lets the final output path escape the selected output directory, allowing an attacker who can cause a user to run wakaru --unpack on a malicious bundle to write files outside that directory and, depending on the target path and environment, potentially achieve code execution. This issue is fixed in @wakaru/cli 1.4.0.