Executive Summary

A critical vulnerability (CVE-2026-82635) with a CVSS score of 8.8 affects Pake versions before 3.13.1. This vulnerability allows attackers to execute code on user accounts by overwriting user-writable files, potentially leading to persistence and code execution. All desktop apps generated from an affected Pake tree are vulnerable.

Technical Analysis

This vulnerability is classified as a path traversal issue (CWE-22). The download_file Tauri command in Pake joins a JavaScript-supplied filename with the user's Downloads directory without proper sanitization. This allows an attacker to provide a filename containing path traversal sequences (e.g., ../Library/LaunchAgents/com.evil.plist) or an absolute path, which resolves outside the ~/Downloads directory.

The command then fetches content from an attacker-controlled URL and writes it to the specified path. A script that can invoke this command can overwrite user-writable files and install persistence mechanisms such as macOS LaunchAgents, Linux autostart, or Windows Startup, leading to code execution in the user account.

How It Gets Exploited

An attacker would start by crafting a malicious filename containing path traversal sequences or an absolute path. A script within a vulnerable desktop app would then invoke the download_file command with this crafted filename and a URL pointing to attacker-controlled content. When the command is executed, it would resolve the path, fetch the content, and write it to the target location. For example, an attacker might use a filename like ../Library/LaunchAgents/com.evil.plist to install a malicious LaunchAgent on a macOS system, achieving persistence and potentially executing malicious code.

Impact Assessment

The impact of this vulnerability is high, with a CVSS score of 8.8. Successful exploitation can lead to code execution in the user account, allowing attackers to overwrite user-writable files, install persistence mechanisms, and potentially gain elevated privileges. All desktop apps generated from an affected Pake tree are vulnerable, making the blast radius significant.

Recommended Actions

To mitigate this vulnerability, update Pake to version 3.13.1 or later. Additionally:

  • Ensure all desktop apps generated from the affected Pake tree are updated to use the patched version.
  • Implement strict input validation for filenames and paths in the download_file command.
  • Restrict the execution of the download_file command to only necessary scripts and users.
  • Monitor for suspicious activity related to the download_file command and unusual file writes.

Sources