npm pake-cli vulnerabilities

Latest npm pake-cli CVEs

Newest publication first

1. CVE-2026-96454 Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications

   Published 2026-09-23

   High·CVSS 8.2 EPSS 0.48%

   Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.