Executive brief
Wakaru is a toolkit used by developers to decompile and unminify JavaScript code. A security flaw in its command-line interface allows a malicious JavaScript bundle to write files to arbitrary locations on a user's computer when the 'unpack' command is used. This could allow an attacker to overwrite sensitive system files or plant malicious code, potentially leading to a full system compromise if a user is tricked into processing a specially crafted file.
Technical details
A path traversal vulnerability (CWE-22) exists in @wakaru/cli from version 1.0.0 to 1.3.9. The root cause is that the application performs a single-pass sanitization of bundle-controlled module filenames before writing them to the disk. An attacker can craft filenames with overlapping traversal sequences (e.g., '....//') that collapse into valid traversal sequences (e.g., '../') after the initial sanitization pass. When a user runs 'wakaru --unpack' on such a malicious bundle, the tool writes files outside the intended output directory. This can lead to arbitrary file overwrite and potentially remote code execution if the attacker targets startup scripts or configuration files. The issue is resolved in version 1.4.0 by implementing component-by-component path sanitization and verifying output paths against the canonical output directory.
Affected products
- pionxzh wakaru >= 1.0.0, < 1.4.0
Timeline
- 2026-06-05: patched: Fixed in version 1.4.0 and commit 1d30383b20a6f768786b8ada2f1b0945de13c316
- 2026-07-28: disclosed: Public advisory published via GitHub and NVD