Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue within the @wakaru/cli tool's bundle unpacking feature. The root cause was improper sanitization of module filenames sourced from the input bundle. Multiple sanitize_filename and sanitize_path functions across different unpacker modules (for esbuild, SystemJS, Webpack 4, and Webpack 5) used naive string replacement or trimming to remove ../ sequences. This method was insecure because it could be bypassed using overlapping characters; for instance, a malicious filename like ....// would be transformed into ../ after a single sanitization pass, enabling directory traversal.
The run_default function in crates/cli/src/main.rs was the high-level function that consumed these improperly sanitized paths, joined them with the base output directory, and wrote the files, triggering the vulnerability.
The patch addresses this comprehensively. It introduces a new, secure sanitization function, sanitize_relative_path, which operates on path components rather than using string replacement, thus preventing the bypass. Furthermore, the file writing logic in run_default was hardened significantly by adding multiple layers of validation, including canonicalizing paths and explicitly checking at each step of directory creation that the path remains within the intended output directory.
run_defaultcrates/cli/src/main.rs
sanitize_pathcrates/core/src/unpacker/esbuild.rs
sanitize_filenamecrates/core/src/unpacker/systemjs.rs
sanitize_filenamecrates/core/src/unpacker/webpack4.rs
sanitize_filenamecrates/core/src/unpacker/webpack5.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @wakaru/cli | npm | >= 1.0.0, < 1.4.0 | 1.4.0 |