CVE-2025-31488

Plain Craft Launcher's custom homepage can use Internet Explorer to load web pages with the help of controls such as WebBrowser

State: Published
Severity: 4.9 Medium
Published: Apr 6, 2025
Updated: Apr 7, 2025
Reserved: Mar 28, 2025

Read the record on cve.org

Description

Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in the homepage, WPF will use Internet Explorer to load the specified webpage. If the user uses a malicious homepage, the attacker can use IE background to access the specified webpage without knowing it. This vulnerability is fixed in 2.9.3.

Scores

CVSS	Score	Vector	Source
4.0	4.9 Medium	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
PCL2Hex-Dragon	< 2.9.3Affected

References

https://github.com/Hex-Dragon/PCL2/security/advisories/GHSA-wfpw-hfcp-9m73

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.