CVE-2025-31488
Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowser
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowser
Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE background to access the specified webpage without knowing it. This vulnerability is fixed in 2.9.3.
Reserved 2025-03-28 | Published 2025-04-06 | Updated 2025-04-07 | Assigner GitHub_MCWE-20: Improper Input Validation
github.com/...n/PCL2/security/advisories/GHSA-wfpw-hfcp-9m73
Support options
