GHSA-2rcp-jvr4-r259 · 深刻度： high · エコシステム： rust — Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: ['VITE_', 'TAURI_'],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: ['VITE_'],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
総合評価: CVE-2023-46115 は低リスク（36.9/100）。CVSS 深刻度は高。悪用される可能性が高い（EPSS 0.19%、9 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.06% | 0.19% | +0.13% |
| 2 | 2025-11-21 | 0.05% | 0.06% | +0.01% |
| 3 | 2025-11-18 | — | 0.05% | — |
EPSS の全履歴 （全 7 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 8.4 | 3.1 | HIGH |
|
2.0 | 5.8 | [email protected] |
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
GHSA-2rcp-jvr4-r259 · 深刻度： high · エコシステム： rust — Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| tauri | tauri | < 2.0.0 | cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha0:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha10:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha11:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha12:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha13:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha14:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha15:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha2:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha3:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha4:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha5:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha6:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha7:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha8:*:*:*:*:*:* |
| tauri | tauri | 2.0.0 | cpe:2.3:a:tauri:tauri:2.0.0:alpha9:*:*:*:*:*:* |