File Path Manipulation in JavaScript Decompiler by PionXzh
CVE-2026-54545

7.1HIGH

Key Information:

Vendor

Pionxzh

Status
Wakaru
Vendor
CVE Published:
28 July 2026

What is CVE-2026-54545?

The wakaru JavaScript decompiler and unminifier toolkit, versions 1.0.0 through 1.4.0, is susceptible to a file path manipulation issue. Due to insufficient sanitization of bundle-controlled module filenames, crafted filenames with overlapping traversal sequences can allow attackers to escape the designated output directory. This could enable an attacker, who convinces a user to execute wakaru --unpack with a malicious bundle, to write files externally, potentially leading to unauthorized code execution. The vulnerability has been resolved in version 1.4.0.

Affected Version(s)

wakaru >= 1.0.0, < 1.4.0

References

https://github.com/pionxzh/wakaru/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/pionxzh/wakaru/commit/1d30383b20a6f768...
x_refsource_MISC
https://github.com/pionxzh/wakaru/releases/tag/v1.4.0
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.