A sanitization bug in the @wakaru/cli tool allows crafted bundle filenames to escape the intended output directory during unpacking, enabling an attacker who can supply a malicious bundle to write files outside the designated folder. This path traversal flaw can lead to arbitrary file overwrite and, depending on the target path, may allow code execution. The likely attack vector is that an attacker distributes a malicious bundle and a user runs the `wakaru --unpack` command, an inference drawn from the description because the vulnerability description mentions a user‑initiated unpack action.

The JavaScript decompiler and unminifier toolkit wakaru, specifically its CLI component @wakaru/cli version 1.0.0 through 1.3.x, is affected. Users of any of these releases that invoke the --unpack option are potentially impacted. The issue was resolved in @wakaru/cli 1.4.0, which removed the single‑pass sanitization and correctly restricts output paths.

The CVSS score of 7.1 indicates a substantial threat, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted bundle and convince a user to run the unpack command. If the output directory permits writing to privileged system locations, the attacker could place malicious binaries or scripts, resulting in local code execution or potential privilege escalation.