{"cve":"CVE-2024-43373","nvd":{"published":"2024-08-15T15:15:21.217","modified":"2026-06-17T07:50:54.403","status":"Analyzed","description":"webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system. This vulnerability allows an attacker to write arbitrary `.js` files to the host system, which can be leveraged to hijack legitimate Node.js modules to gain arbitrary code execution. This vulnerability has been patched in version 2.14.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-22","CWE-20"],"references":["https://github.com/j4k0xb/webcrack/blob/241f9469e6401f3dabc6373233d85a5e76966b54/packages/webcrack/src/unpack/bundle.ts#L79","https://github.com/j4k0xb/webcrack/commit/4bc5c6f353012ee7edc2cb39d01a728ab7426999","https://github.com/j4k0xb/webcrack/security/advisories/GHSA-ccqh-278p-xq6w"],"products":["j4k0xb:webcrack"],"source":"nvd","synced_at":"2026-10-19T21:54:16.205165117+00:00"},"epss":{"cve":"CVE-2024-43373","score":0.00447,"percentile":0.38934,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-ccqh-278p-xq6w","url":"https://osv.dev/vulnerability/GHSA-ccqh-278p-xq6w","summary":"webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle","modified":"2024-11-18T16:27:04Z","packages":[{"ecosystem":"npm","name":"webcrack","purl":"pkg:npm/webcrack","ranges":["<2.14.1"],"fixed":["2.14.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}