CVE-2026-82635

Pake before 3.13.1 fails to sanitize the filename passed to its download_file Tauri command, so filenames containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or absolute paths resolve outside the user's Downloads directory. Any script or page that can invoke the command triggers the flaw: the app fetches attacker-controlled content from a supplied URL over Rust HTTP (not the browser) and writes it to the attacker-chosen path. An attacker can thereby overwrite user-writable files and plant persistence such as macOS LaunchAgents, Linux autostart entries, or Windows Startup items, achieving code execution in the user's account. All desktop applications generated from an affected Pake tree are affected across macOS, Linux, and Windows; the CVSS 3.1 score of 8.8 (high) reflects a network attack vector requiring user interaction. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS estimates only a 0.4% probability of exploitation within the next 30 days.

What to do: Upgrade Pake to 3.13.1 or later and rebuild and redistribute any desktop apps generated from earlier builds. Until rebuilt, be cautious with untrusted scripts or pages that can invoke the download_file command inside Pake-wrapped apps, and audit macOS LaunchAgents, Linux autostart directories, and Windows Startup folders for unexpected persistence entries. Monitor for public PoCs given the straightforward exploitation path.