CVE-2026-82635 tw93 CVE debrief

Who should care

Users of Pake versions before 3.13.1, especially those with desktop apps generated from affected Pake trees, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 3.13.1 or later, verifying and restricting access to the download_file Tauri command, and monitoring for suspicious activity related to Pake installations. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and plan vendor-supported updates or mitigations through normal change control.

Technical summary

Pake before version 3.13.1 has a vulnerability allowing code execution via path traversal in the download_file Tauri command. This command joins the JavaScript-supplied filename for the download onto the user's Downloads directory with no sanitization, allowing an attacker to overwrite user-writable files and install persistence. The vulnerability can be exploited by a script that can invoke the command, leading to code execution in the user account.

Defensive priority

Pake users should prioritize updating to version 3.13.1 or later to mitigate this vulnerability.

Recommended defensive actions

• Update Pake to version 3.13.1 or later
• Verify and restrict access to the download_file Tauri command
• Monitor for suspicious activity related to Pake installations
• Review the official advisory for affected scope and severity
• Plan vendor-supported updates or mitigations through normal change control
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The evidence for this CVE is limited. The CVE record indicates that Pake before version 3.13.1 has a vulnerability allowing code execution via path traversal in the download_file Tauri command. Users should verify affected versions and update to 3.13.1 or later. Additional verification tasks include reviewing the official advisory, checking for suspicious activity related to Pake installations, and ensuring that compensating controls are in place for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.