@wakaru/cli arbitrary file write during bundle unpack
@wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with –unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as ….//, could be transformed into ../ after sanitization. This allowed the final output path to escape the intended output directory. An attacker who can cause a user to run wakaru –unpack on …