npm/@tauri-apps/cli CVE-2023-46115: high 8.4, EPSS 0.20%
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
Action: Upgrade @tauri-apps/cli to 1.5.6 or later.
npm i @tauri-apps/cli@2.0.0-alpha.16npm i @tauri-apps/cli@1.5.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0-alpha.0 | 2.0.0-alpha.16 | - |
| 1.0.0 | 1.5.6 | - |
Fixed versions
| 2.0.0-alpha.16 | 1.5.6 |
Sources
- osv: GHSA-2rcp-jvr4-r259#npm/@tauri-apps/cli
- https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259
- https://nvd.nist.gov/vuln/detail/CVE-2023-46115
- https://github.com/tauri-apps/tauri/commit/8b166e9bf82e69ddb3200a3a825614980bd8d433
- https://discord.com/channels/616186924390023171/1164260301655523409
- https://github.com/tauri-apps/tauri
- https://tauri.app/v1/guides/getting-started/setup/vite
CVE-2023-46115 · published · modified · JSON