CVE-2023-46115
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedTauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: ['VITE_', 'TAURI_'],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: ['VITE_'],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceTauri applications using Vite frontend with the insecure `envPrefix: ['VITE_', 'TAURI_']` configuration in vite.config.ts will have `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` environment variables bundled into the frontend JavaScript code, exposing sensitive cryptographic keys in the released application.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2.0.0= 2.0.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Tauri application with Vite frontendLocate the vite.config.ts file in the project root directory. This file exists if the Tauri application uses Vite as its frontend build tool.Affected if The project uses Tauri with a Vite-based frontend (vite.config.ts present)
-
Check envPrefix configurationOpen vite.config.ts and inspect the envPrefix setting in the defineConfig object. Look for a line containing envPrefix and its assigned array value.Affected if envPrefix is set to ['VITE_', 'TAURI_'] or includes 'TAURI_' (both allow TAURI_ prefixed env vars to be exposed)
-
Inspect built JavaScript for exposed keysBuild the application using the standard build command (e.g., tauri build). In the resulting frontend bundle (typically in src-tauri/target/release/bundle/ or similar output directory), search the .js files for string literals containing 'TAURI_PRIVATE_KEY' or 'TAURI_KEY_PASSWORD'. Use grep or a text editor to search.Affected if The built JavaScript files contain the literal strings 'TAURI_PRIVATE_KEY' or 'TAURI_KEY_PASSWORD', indicating these values were bundled into the frontend code
A user is affected if their Tauri application's vite.config.ts contains envPrefix that includes 'TAURI_' and the built frontend JavaScript exposes sensitive key variables.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2.0.0
Change envPrefix to `['VITE_']` only, then rotate the updater private key using `tauri signer generate` and update the public key in tauri.conf.json. The next build must be signed with the old key to maintain update compatibility with existing installations.
- Edit vite.config.ts and change envPrefix from ['VITE_', 'TAURI_'] to envPrefix: ['VITE_'] to prevent sensitive Tauri environment variables from being exposed to the frontend bundle
- If your private key may have been leaked, rotate it by running `tauri signer generate` to create a new key pair
- Update the tauri.conf.json file: replace the old public key in the updater configuration with the new public key from the generated key pair
- Store the new private key securely (do not commit to version control)
- For the next build, ensure you sign with the old private key first if you need to update an existing installed application that still has the old public key
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation3.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-46115 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-46115 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data