{"answers":{"affected":"8 open source packages ship an affected version, including @tauri-apps/cli and tauri-cli. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46115 exists.","fix":"Upgrade @tauri-apps/cli to a fixed version for your release line: 1.5.6 or 2.0.0-alpha.16.","what":"CVE-2023-46115 is a high-severity vulnerability in tauri-apps tauri, published on 19 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-46115 and fix it if it is affected.\n\nWhat it is: CVE-2023-46115 is a high-severity vulnerability in tauri-apps tauri, published on 19 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46115 exists.\n\nAffected packages and fixed versions:\n- @tauri-apps/cli (npm): affected from 1.0.0; fixed in 1.5.6\n- @tauri-apps/cli (npm): affected from 1.0.0; fixed in 1.5.6\n- @tauri-apps/cli (npm): affected from 2.0.0-alpha.0; fixed in 2.0.0-alpha.16\n- @tauri-apps/cli (npm): affected from 2.0.0-alpha.0; fixed in 2.0.0-alpha.16\n- tauri-cli (crates.io): affected from 1.0.0; fixed in 1.5.6\n- tauri-cli (crates.io): affected from 1.0.0; fixed in 1.5.6\n- tauri-cli (crates.io): affected from 2.0.0-alpha.0; fixed in 2.0.0-alpha.16\n- tauri-cli (crates.io): affected from 2.0.0-alpha.0; fixed in 2.0.0-alpha.16\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-46115/ (Markdown: https://insights.sbomify.com/CVE-2023-46115/index.md)","id":"CVE-2023-46115","markdown":"https://insights.sbomify.com/CVE-2023-46115/index.md","name":"CVE-2023-46115","record":{"aliases":["GHSA-2rcp-jvr4-r259"],"analysis":{"component_type":"developer_tool","fix_type":"configuration_change","impacts":["data_read","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Tauri CLI","requires_auth":"low_privilege","summary":"Developers using a specific Vite configuration may leak Tauri updater private keys, allowing attackers to bypass update signatures.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"tauri","vendor":"tauri"}],"cvss":{"score":8.4,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite.  Copying the following snippet `envPrefix: ['VITE_', 'TAURI_'],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: ['VITE_'],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI \u003e=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.","ecosystems":["crates.io","npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli","id":"CVE-2023-46115","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"information_disclosure","year":"2023"},"n_packages":8,"n_references":2,"next":{"headline":"Remote Code Execution via insufficiently sanitized call to shell.openExternal","id":"CVE-2023-46116"},"packages":[{"ecosystem":"crates.io","fixed":["1.5.6"],"introduced":["1.0.0"],"last_affected":[],"package":"tauri-cli","purl":null,"source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"crates.io","fixed":["1.5.6"],"introduced":["1.0.0"],"last_affected":[],"package":"tauri-cli","purl":"pkg:cargo/tauri-cli","source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"crates.io","fixed":["2.0.0-alpha.16"],"introduced":["2.0.0-alpha.0"],"last_affected":[],"package":"tauri-cli","purl":null,"source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"crates.io","fixed":["2.0.0-alpha.16"],"introduced":["2.0.0-alpha.0"],"last_affected":[],"package":"tauri-cli","purl":"pkg:cargo/tauri-cli","source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"npm","fixed":["1.5.6"],"introduced":["1.0.0"],"last_affected":[],"package":"@tauri-apps/cli","purl":null,"source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"npm","fixed":["1.5.6"],"introduced":["1.0.0"],"last_affected":[],"package":"@tauri-apps/cli","purl":"pkg:npm/%40tauri-apps/cli","source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"npm","fixed":["2.0.0-alpha.16"],"introduced":["2.0.0-alpha.0"],"last_affected":[],"package":"@tauri-apps/cli","purl":null,"source":"GHSA-2rcp-jvr4-r259"},{"ecosystem":"npm","fixed":["2.0.0-alpha.16"],"introduced":["2.0.0-alpha.0"],"last_affected":[],"package":"@tauri-apps/cli","purl":"pkg:npm/%40tauri-apps/cli","source":"GHSA-2rcp-jvr4-r259"}],"prev":{"headline":"Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb","id":"CVE-2023-46104"},"products":["tauri"],"published":"2023-10-19","related":[{"cvss_score":8.3,"headline":"The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri","id":"CVE-2022-39215","kev_date_added":null,"published":"2022-09-15"},{"cvss_score":6.8,"headline":"Tauri vulnerable to path traversal","id":"CVE-2022-46171","kev_date_added":null,"published":"2022-12-23"},{"cvss_score":6.1,"headline":"Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands","id":"CVE-2026-42184","kev_date_added":null,"published":"2026-05-27"},{"cvss_score":4.8,"headline":"Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles","id":"CVE-2023-34460","kev_date_added":null,"published":"2023-06-23"},{"cvss_score":4.8,"headline":"Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites","id":"CVE-2023-31134","kev_date_added":null,"published":"2023-05-09"},{"cvss_score":2.6,"headline":"Tauri Filesystem Scope can be Partially Bypassed","id":"CVE-2022-41874","kev_date_added":null,"published":"2022-11-10"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-09-12","vendors":["tauri-apps"]},"summary":"Developers using a specific Vite configuration may leak Tauri updater private keys, allowing attackers to bypass update signatures.","url":"https://insights.sbomify.com/CVE-2023-46115/"}