CVE-2026-54545: @wakaru/cli arbitrary file write during bundle unpack

@wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack.

Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as ....//, could be transformed into ../ after sanitization. This allowed the final output path to escape the intended output directory.

An attacker who can cause a user to run wakaru --unpack on a malicious bundle may be able to write files outside the selected output directory. Depending on the target path and user environment, this may lead to code execution.

Affected versions: >=1.0.0 <1.4.0.