CVE-2024-43373

webcrack is a tool for reverse engineering javascript. An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system. This vulnerability allows an attacker to write arbitrary `.js` files to the host system, which can be leveraged to hijack legitimate Node.js modules to gain arbitrary code execution. This vulnerability has been patched in version 2.14.1.

• CWE-20
• CWE-22
• CWE-22

• https://github.com/j4k0xb/webcrack/blob/241f9469e6401f3dabc6373233d85a5e76966b54/packages/webcrack/src/unpack/bundle.ts#L79Product
• https://github.com/j4k0xb/webcrack/commit/4bc5c6f353012ee7edc2cb39d01a728ab7426999Patch
• https://github.com/j4k0xb/webcrack/security/advisories/GHSA-ccqh-278p-xq6wExploit, Vendor Advisory

Published

Aug 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43368The Trix editor, versions prior to 2.1.4, is vulnerable to X…6.5
• CVE-2024-43369Ibexa RichText Field Type is a Field Type for supporting ric…7.2
• CVE-2024-4337Adive Framework 2.0.8, does not sufficiently encode user-con…7.4
• CVE-2024-43370gettext.js is a GNU gettext port for node and the browser. T…7.2
• CVE-2024-43371CKAN is an open-source data management system for powering d…6.5
• CVE-2024-43372Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-43374The UNIX editor Vim prior to version 9.1.0678 has a use-afte…4.7
• CVE-2024-43376Umbraco is an ASP.NET CMS. Some endpoints in the Management …5.3
• CVE-2024-43377Umbraco CMS is an ASP.NET CMS. An authenticated user can acc…4.3
• CVE-2024-43378calamares-nixos-extensions provides Calamares branding and m…7.8
• CVE-2024-43379TruffleHog is a secrets scanning tool. Prior to v3.81.9, thi…3.1
• CVE-2024-43380fugit contains time tools for flor and the floraison group. …7.5