CVE-2026-82635

Name of the Vulnerable Software and Affected Versions Pake versions prior to 3.13.1

Description The download file Tauri command fails to sanitize the JavaScript-supplied filename before joining it to the user's Downloads directory. This allows a filename containing an absolute path or path traversal sequences (such as ../) to resolve to locations outside the intended directory. The command then fetches content from a supplied URL using Rust HTTP and writes it to the resolved path. A script capable of invoking this command can overwrite user-writable files to establish persistence, such as through macOS LaunchAgents, Linux autostart, or Windows Startup, resulting in code execution within the user account. All desktop applications generated from an affected Pake tree are subject to this issue.

Recommendations Update Pake to version 3.13.1 or later.