Pake
Monthly
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.
Path traversal in Pake before 3.13.1 allows a malicious or compromised web page loaded inside any Pake-generated desktop app to write attacker-fetched content to arbitrary user-writable filesystem locations, including persistence directories. The `download_file` Tauri command accepted a JavaScript-supplied filename and joined it directly to the Downloads directory without stripping path separators or sanitizing sequences such as `../`, enabling writes to locations such as `~/Library/LaunchAgents/` on macOS, `~/.config/autostart/` on Linux, or the Windows Startup folder. Because the HTTP fetch is performed by the Rust backend rather than the sandboxed browser renderer, browser-level download restrictions do not apply. No public exploit is identified at time of analysis, though the attack primitive is straightforward given JFrog's public disclosure.