Remote Code Execution Vulnerability in Pake by Tauri

CVE-2026-96454

What is CVE-2026-96454?

The Pake framework, utilized for transforming websites into desktop applications via Tauri, is susceptible to a significant vulnerability. This flaw allows malicious web content to leverage native functionalities within the application. Specifically, Pake's settings enable Inter-Process Communication (IPC) from any HTTPS source by permitting a wildcard in the access list. Additionally, the absence of access control checks for app commands means that any script running within a Pake-generated application can execute potentially harmful native commands. This is particularly dangerous as it includes third-party scripts, which could form a conduit for arbitrary file operations and persistent code execution, greatly impacting application integrity.

References