Answer in brief
CVE-2026-54545 records a High severity path traversal vulnerability in @wakaru/cli arbitrary file write during bundle unpack. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-54545 records a High severity path traversal vulnerability in @wakaru/cli arbitrary file write during bundle unpack. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update @wakaru/cli to 1.4.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54545 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @wakaru/clinpm | >=1.0.0,<1.4.0 | 1.4.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54545 records a High severity path traversal vulnerability in @wakaru/cli arbitrary file write during bundle unpack. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @wakaru/cli.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @wakaru/cli to 1.4.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPath Traversal describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54545 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @wakaru/clinpm | >=1.0.0,<1.4.0 | 1.4.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54545 records a High severity path traversal vulnerability in @wakaru/cli arbitrary file write during bundle unpack. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @wakaru/cli.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Impact `@wakaru/cli` is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with `--unpack`. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as `....//`, could be transformed into `../` after sanitization. This allowed the final output path to escape the intended output directory. An attacker who can cause a user to run `wakaru --unpack` on a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution. Affected versions: `>=1.0.0 <1.4.0`. ### Patches The issue has been patched in `@wakaru/[email protected]`. Users should upgrade to: ```sh npm install @wakaru/cli@latest ``` or specifically: ``` npm install @wakaru/[email protected] ``` ### Workarounds Do not run `wakaru --unpack` on untrusted or unknown bundles with affected versions. If upgrading immediately is not possible, avoid using `--unpack on files that may be attacker-controlled.
### Impact `@wakaru/cli` is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with `--unpack`. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as `....//`, could be transformed into `../` after sanitization. This allowed the final output path to escape the intended output directory. An attacker who can cause a user to run `wakaru --unpack` on a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution. Affected versions: `>=1.0.0 <1.4.0`. ### Patches The issue has been patched in `@wakaru/[email protected]`. Users should upgrade to: ```sh npm install @wakaru/cli@latest ``` or specifically: ``` npm install @wakaru/[email protected] ``` ### Workarounds Do not run `wakaru --unpack` on untrusted or unknown bundles with affected versions. If upgrading immediately is not possible, avoid using `--unpack on files that may be attacker-controlled.