Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
26 vulnerabilities by Tauri
CVE-2026-95627 (GCVE-0-2026-95627)
Vulnerability from nvd – Published: 2026-09-23 09:43 – Updated: 2026-09-23 14:22
VLAI
EPSS
VEX
Title
Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion
Summary
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:21 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | issue-tracking |
| https://github.com/tauri-apps/plugins-workspace | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-dialog |
Affected:
2.0.0 , ≤ *
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:21:31.658846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:22:55.260Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-dialog",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-dialog",
"product": "tauri-plugin-dialog",
"programFiles": [
"plugins/dialog/src/commands.rs"
],
"repo": "git://github.com/tauri-apps/plugins-workspace",
"vendor": "Tauri",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen a Tauri application uses the dialog plugin\u0027s file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.\u003c/p\u003e"
}
],
"value": "When a Tauri application uses the dialog plugin\u0027s file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Script in the webview gets read and write access to a whole directory tree, after one click on a dialog that looked completely normal. Aim it at the home folder and that is everything the user owns. The script does not need any privileges of its own to ask; an XSS in content the app renders is enough."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:43:04.542Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-vw89-89jm-wmqc (tauri-apps/plugins-workspace)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-vw89-89jm-wmqc"
},
{
"name": "tauri-apps/plugins-workspace repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/plugins-workspace"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThe fix is to stop taking the recursion flag from the caller. Grant what was actually chosen: the one file, or the one folder and nothing below it. An app that genuinely needs a recursive grant can ask for one in its own Rust code, where the frontend cannot reach it.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The fix is to stop taking the recursion flag from the caller. Grant what was actually chosen: the one file, or the one folder and nothing below it. An app that genuinely needs a recursive grant can ask for one in its own Rust code, where the frontend cannot reach it."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-28T08:23:00.000Z",
"value": "Reported to the Tauri team as GHSA-vw89-89jm-wmqc"
}
],
"title": "Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95627",
"datePublished": "2026-09-23T09:43:04.542Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-23T14:22:55.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95626 (GCVE-0-2026-95626)
Vulnerability from nvd – Published: 2026-09-23 09:33 – Updated: 2026-09-23 14:03
VLAI
EPSS
VEX
Title
Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
Summary
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:03 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | issue-tracking |
| https://github.com/tauri-apps/tauri | product |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95626",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:03:10.553800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:03:18.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri",
"defaultStatus": "unaffected",
"packageName": "tauri",
"product": "tauri",
"programFiles": [
"crates/tauri-utils/src/html.rs",
"crates/tauri/src/manager/mod.rs"
],
"repo": "git://github.com/tauri-apps/tauri",
"vendor": "Tauri",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTauri\u0027s Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Tauri\u0027s Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:33:09.366Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-6vxm-x265-58qf (tauri-apps/tauri)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6vxm-x265-58qf"
},
{
"name": "tauri-apps/tauri repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/tauri"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-17T16:46:00.000Z",
"value": "Reported to the Tauri team as GHSA-6vxm-x265-58qf"
}
],
"title": "Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95626",
"datePublished": "2026-09-23T09:33:09.366Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-23T14:03:18.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95625 (GCVE-0-2026-95625)
Vulnerability from nvd – Published: 2026-09-23 08:51 – Updated: 2026-09-23 14:10
VLAI
EPSS
VEX
Title
Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
Summary
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:07 UTC
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | issue-tracking |
| https://github.com/tauri-apps/plugins-workspace | product |
| https://github.com/tauri-apps/plugins-workspace/c… | patch |
| https://github.com/tauri-apps/plugins-workspace/r… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-updater |
Affected:
2.0.0 , < 2.12.0
(semver)
Affected: 2.12.0 , ≤ * (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:07:42.715205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:10:35.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-updater",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-updater",
"product": "tauri-plugin-updater",
"programFiles": [
"plugins/updater/src/updater.rs",
"plugins/updater/src/config.rs"
],
"repo": "git://github.com/tauri-apps/plugins-workspace",
"vendor": "Tauri",
"versions": [
{
"lessThan": "2.12.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest\u0027s version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer\u0027s private key.\u003c/p\u003e"
}
],
"value": "The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest\u0027s version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer\u0027s private key."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T08:51:53.922Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-j38x-g3m3-95fr (tauri-apps/plugins-workspace)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-j38x-g3m3-95fr"
},
{
"name": "tauri-apps/plugins-workspace repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/plugins-workspace"
},
{
"name": "Add requireSignedVersion to bind an update to its signed version",
"tags": [
"patch"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/690dcfd694"
},
{
"name": "tauri-plugin-updater 2.12.0 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eaddressed in tauri-plugin-updater 2.12.0, and it has to be switched on. The new requireSignedVersion option compares the version announced by the endpoint against the version recorded in the signature\u0027s trusted comment, which the signature does cover, and rejects the update when they differ.\u003c/p\u003e"
}
],
"value": "addressed in tauri-plugin-updater 2.12.0, and it has to be switched on. The new requireSignedVersion option compares the version announced by the endpoint against the version recorded in the signature\u0027s trusted comment, which the signature does cover, and rejects the update when they differ."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-01T13:31:00.000Z",
"value": "Reported to the Tauri team as GHSA-j38x-g3m3-95fr"
},
{
"lang": "en",
"time": "2026-09-19T23:57:00.000Z",
"value": "Opt-in fix released in tauri-plugin-updater 2.12.0, commit 690dcfd694, adding the requireSignedVersion option"
}
],
"title": "Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95625",
"datePublished": "2026-09-23T08:51:53.922Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-23T14:10:35.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95624 (GCVE-0-2026-95624)
Vulnerability from nvd – Published: 2026-09-22 17:16 – Updated: 2026-09-22 19:30
VLAI
EPSS
VEX
Title
Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
Summary
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:30 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | issue-tracking |
| https://github.com/tauri-apps/tauri | product |
| https://github.com/tauri-apps/plugins-workspace/c… | patch |
| https://github.com/tauri-apps/plugins-workspace/r… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-updater |
Affected:
2.8.0 , < 2.12.0
(semver)
|
Date Public
2026-09-23 10:14
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:30:03.565802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:30:22.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-updater",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-updater",
"product": "tauri-plugin-updater",
"programFiles": [
"plugins/updater/src/commands.rs",
"plugins/updater/src/config.rs"
],
"repo": "git://github.com/tauri-apps/tauri",
"vendor": "Tauri",
"versions": [
{
"lessThan": "2.12.0",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"datePublic": "2026-09-23T10:14:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Tauri updater plugin\u0027s \u0027check\u0027 IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from \"update must be newer\" to \"update must be different.\" Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.\u003c/p\u003e"
}
],
"value": "The Tauri updater plugin\u0027s \u0027check\u0027 IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from \"update must be newer\" to \"update must be different.\" Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:16:25.195Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-rjc6-5hfg-grp9 (tauri-apps/tauri)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-rjc6-5hfg-grp9"
},
{
"name": "tauri-apps/tauri repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/tauri"
},
{
"name": "Move allowDowngrades from the check command to the plugin configuration",
"tags": [
"patch"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/1308bfa399b962b3977c767100a6339d1cbfdd20"
},
{
"name": "tauri-plugin-updater 2.12.0 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFixed in tauri-plugin-updater 2.12.0. allowDowngrades was removed from the check command and is now read from the plugin configuration instead, where the frontend cannot reach it, and it defaults to false. An application that provides its own version comparator still takes precedence.\u003c/p\u003e"
}
],
"value": "Fixed in tauri-plugin-updater 2.12.0. allowDowngrades was removed from the check command and is now read from the plugin configuration instead, where the frontend cannot reach it, and it defaults to false. An application that provides its own version comparator still takes precedence."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-25T09:40:00.000Z",
"value": "Reported to the Tauri team as GHSA-rjc6-5hfg-grp9"
},
{
"lang": "en",
"time": "2026-09-20T00:00:00.000Z",
"value": "Fixed in tauri-plugin-updater 2.12.0, commit 1308bfa399, by moving allowDowngrades out of the IPC command and into the plugin configuration"
}
],
"title": "Tauri framework v2 malicious downgrade via allow_downgrades from frontend code",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95624",
"datePublished": "2026-09-22T17:16:25.195Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-22T19:30:22.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95623 (GCVE-0-2026-95623)
Vulnerability from nvd – Published: 2026-09-22 10:52 – Updated: 2026-09-22 17:17
VLAI
EPSS
VEX
Title
Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
Summary
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 12:28 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | issue-tracking |
| https://github.com/tauri-apps/plugins-workspace | product |
| https://github.com/tauri-apps/plugins-workspace/c… | patch |
| https://github.com/tauri-apps/plugins-workspace/r… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-http |
Affected:
2.0.0 , ≤ 2.6.1
(semver)
Affected: 2.7.0 , ≤ * (semver) |
Date Public
2026-09-23 10:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T12:28:50.708719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T12:28:59.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-http",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-http",
"product": "tauri-plugin-http",
"programFiles": [
"plugins/http/src/commands.rs",
"plugins/http/src/scope.rs",
"plugins/http/src/config.rs"
],
"repo": "git://github.com/tauri-apps/plugins-workspace",
"vendor": "Tauri",
"versions": [
{
"lessThanOrEqual": "2.6.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVersions 2.0.0 through 2.6.1 are affected in every configuration and no fix is available for them. From 2.7.0 the plugin can check the scope on each redirect hop, but only when the application sets the scopeRedirects option in its http plugin configuration. A 2.7.0 or later application that does not set it behaves as before and is still affected.\u003c/p\u003e"
}
],
"value": "Versions 2.0.0 through 2.6.1 are affected in every configuration and no fix is available for them. From 2.7.0 the plugin can check the scope on each redirect hop, but only when the application sets the scopeRedirects option in its http plugin configuration. A 2.7.0 or later application that does not set it behaves as before and is still affected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"datePublic": "2026-09-23T10:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Tauri HTTP plugin validates requested URLs against the application\u0027s configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.\u003c/p\u003e"
}
],
"value": "The Tauri HTTP plugin validates requested URLs against the application\u0027s configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Requests the frontend starts reach hosts the scope was written to exclude, and the answer is handed back to it. Internal services and cloud metadata endpoints are the obvious targets."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:17:16.133Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-2rxp-f4w5-6hjr (tauri-apps/plugins-workspace)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-2rxp-f4w5-6hjr"
},
{
"name": "tauri-apps/plugins-workspace repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/plugins-workspace"
},
{
"name": "Check the URL scope on every hop of a redirect chain",
"tags": [
"patch"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/1198a524b710abf2abeb1d9bd7b252402d26ca6d"
},
{
"name": "tauri-plugin-http 2.7.0 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/http-v2.7.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to tauri-plugin-http 2.7.0 or later and turn on the new scopeRedirects option. Both steps are needed. The fix is opt-in, so 2.7.0 on its own still follows a redirect out of scope; the option is what makes the plugin check every hop. Tauri made it opt-in because a redirect that leaves the scope now fails, which changes behaviour for apps that were relying on it.\u003c/p\u003e\u003ccode\u003e {\u0026quot;plugins\u0026quot;: {\u0026quot;http\u0026quot;: {\u0026quot;scopeRedirects\u0026quot;: true}}}\u003c/code\u003e\u003cbr/\u003e\u003cp\u003eNothing in the 2.0.0 to 2.6.1 range has a fix available.\u003c/p\u003e"
}
],
"value": "Upgrade to tauri-plugin-http 2.7.0 or later and turn on the new scopeRedirects option. Both steps are needed. The fix is opt-in, so 2.7.0 on its own still follows a redirect out of scope; the option is what makes the plugin check every hop. Tauri made it opt-in because a redirect that leaves the scope now fails, which changes behaviour for apps that were relying on it.\n\n {\"plugins\": {\"http\": {\"scopeRedirects\": true}}}\n\n\nNothing in the 2.0.0 to 2.6.1 range has a fix available."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-28T08:24:00.000Z",
"value": "Reported to the Tauri team as GHSA-2rxp-f4w5-6hjr"
},
{
"lang": "en",
"time": "2026-09-20T00:01:00.000Z",
"value": "Opt-in fix released in tauri-plugin-http 2.7.0, commit 1198a524, adding the scopeRedirects option"
}
],
"title": "Tauri framework v2 SSRF Protection Bypass via HTTP Redirects",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95623",
"datePublished": "2026-09-22T10:52:20.006Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-22T17:17:16.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42184 (GCVE-0-2026-42184)
Vulnerability from nvd – Published: 2026-05-27 14:29 – Updated: 2026-05-27 15:40
VLAI
EPSS
VEX
Title
Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
Summary
Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-27 15:39 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 2.0, < 2.11.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42184",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T15:39:47.892764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:40:09.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0, \u003c 2.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri\u0027s is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://\u003cscheme\u003e.localhost/ because those platforms\u0027 WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri\u0027s check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T14:29:53.825Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9"
}
],
"source": {
"advisory": "GHSA-7gmj-67g7-phm9",
"discovery": "UNKNOWN"
},
"title": "Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42184",
"datePublished": "2026-05-27T14:29:53.825Z",
"dateReserved": "2026-04-25T01:53:21.583Z",
"dateUpdated": "2026-05-27T15:40:09.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31477 (GCVE-0-2025-31477)
Vulnerability from nvd – Published: 2025-04-02 21:10 – Updated: 2025-04-03 13:59
VLAI
EPSS
VEX
Title
Improper Scope Validation in the open Endpoint of tauri-plugin-shell
Summary
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-03 13:58 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/plugins-workspace/c… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | plugins-workspace |
Affected:
< 2.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T13:58:49.532045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T13:59:36.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "plugins-workspace",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-02T21:10:14.264Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp"
},
{
"name": "https://github.com/tauri-apps/plugins-workspace/commit/9cf0390a52497e273db1a1b613a0e26827aa327c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/9cf0390a52497e273db1a1b613a0e26827aa327c"
}
],
"source": {
"advisory": "GHSA-c9pr-q8gx-3mgp",
"discovery": "UNKNOWN"
},
"title": "Improper Scope Validation in the open Endpoint of tauri-plugin-shell"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-31477",
"datePublished": "2025-04-02T21:10:14.264Z",
"dateReserved": "2025-03-28T13:36:51.297Z",
"dateUpdated": "2025-04-03T13:59:36.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-46115 (GCVE-0-2023-46115)
Vulnerability from nvd – Published: 2023-10-19 23:35 – Updated: 2024-09-12 15:50
VLAI
EPSS
VEX
Title
Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Summary
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: ['VITE_', 'TAURI_'],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: ['VITE_'],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
Severity
8.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-12 15:50 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://tauri.app/v1/guides/getting-started/setup/vite/ | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 2.0.0-alpha.0, < 2.0.0-alpha.16
Affected: >= 1.0.0, < 1.5.6 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:37:39.516Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259"
},
{
"name": "https://tauri.app/v1/guides/getting-started/setup/vite/",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tauri.app/v1/guides/getting-started/setup/vite/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-46115",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T15:50:11.390191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T15:50:32.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0-alpha.0, \u003c 2.0.0-alpha.16"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: [\u0027VITE_\u0027, \u0027TAURI_\u0027],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: [\u0027VITE_\u0027],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI \u003e=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater\u0027s `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-19T19:07:53.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259"
},
{
"name": "https://tauri.app/v1/guides/getting-started/setup/vite/",
"tags": [
"x_refsource_MISC"
],
"url": "https://tauri.app/v1/guides/getting-started/setup/vite/"
}
],
"source": {
"advisory": "GHSA-2rcp-jvr4-r259",
"discovery": "UNKNOWN"
},
"title": "Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-46115",
"datePublished": "2023-10-19T23:35:03.875Z",
"dateReserved": "2023-10-16T17:51:35.570Z",
"dateUpdated": "2024-09-12T15:50:32.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-34460 (GCVE-0-2023-34460)
Vulnerability from nvd – Published: 2023-06-23 19:09 – Updated: 2024-11-07 19:04
VLAI
EPSS
VEX
Title
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Summary
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-07 19:03 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/pull/6969#dis… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/pull/7227 | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/commit/066c09… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
= 1.4.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:10:07.301Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/7227",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/7227"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-34460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T19:03:47.667794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T19:04:00.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "= 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-23T19:09:54.173Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/7227",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/7227"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564"
}
],
"source": {
"advisory": "GHSA-wmff-grcw-jcfm",
"discovery": "UNKNOWN"
},
"title": "Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-34460",
"datePublished": "2023-06-23T19:09:54.173Z",
"dateReserved": "2023-06-06T16:16:53.559Z",
"dateUpdated": "2024-11-07T19:04:00.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31134 (GCVE-0-2023-31134)
Vulnerability from nvd – Published: 2023-05-09 13:09 – Updated: 2025-01-28 17:29
VLAI
EPSS
VEX
Title
Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Summary
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit
arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-28 17:29 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/releases/tag/… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/releases/tag/… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/releases/tag/… | x_refsource_MISC |
| https://www.github.com/tauri-apps/tauri/commit/58… | x_refsource_MISC |
| https://www.github.com/tauri-apps/tauri/commit/fa… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 1.0.0, < 1.0.9
Affected: >= 1.1.0, < 1.1.4 Affected: >= 1.2.0, < 1.2.5 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:45:25.822Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-28T17:29:36.104500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-28T17:29:46.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.9"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.4"
},
{
"status": "affected",
"version": "\u003e= 1.2.0, \u003c 1.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit\narbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T13:09:31.399Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f"
}
],
"source": {
"advisory": "GHSA-4wm2-cwcf-wwvp",
"discovery": "UNKNOWN"
},
"title": "Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-31134",
"datePublished": "2023-05-09T13:09:31.399Z",
"dateReserved": "2023-04-24T21:44:10.416Z",
"dateUpdated": "2025-01-28T17:29:46.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-46171 (GCVE-0-2022-46171)
Vulnerability from nvd – Published: 2022-12-23 13:47 – Updated: 2025-04-15 03:17
VLAI
EPSS
VEX
Title
Tauri vulnerable to path traversal
Summary
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-15 03:14 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/commit/72389b… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/commit/f0602e… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 1.0.0, < 1.0.8
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0, < 1.2.3 Affected: >= 2.0.0-alpha.0, < 2.0.0-alpha.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T14:24:03.235Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-46171",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-15T03:14:09.148755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T03:17:21.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.8"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0, \u003c 1.2.3"
},
{
"status": "affected",
"version": "\u003e= 2.0.0-alpha.0, \u003c 2.0.0-alpha.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-23T13:47:56.494Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58"
}
],
"source": {
"advisory": "GHSA-6mv3-wm7j-h4w5",
"discovery": "UNKNOWN"
},
"title": "Tauri vulnerable to path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-46171",
"datePublished": "2022-12-23T13:47:56.494Z",
"dateReserved": "2022-11-28T17:27:19.998Z",
"dateUpdated": "2025-04-15T03:17:21.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41874 (GCVE-0-2022-41874)
Vulnerability from nvd – Published: 2022-11-10 00:00 – Updated: 2025-04-23 16:38
VLAI
EPSS
VEX
Title
Tauri Filesystem Scope can be Partially Bypassed
Summary
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 13:54 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 1.0.0, <1.0.7
Affected: >= 1.1.0, <1.1.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-q9wv-22m9-vhqh"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41874",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:54:51.769199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:38:40.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c1.0.7"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-10T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-q9wv-22m9-vhqh"
}
],
"source": {
"advisory": "GHSA-q9wv-22m9-vhqh",
"discovery": "UNKNOWN"
},
"title": "Tauri Filesystem Scope can be Partially Bypassed"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41874",
"datePublished": "2022-11-10T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:38:40.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-39215 (GCVE-0-2022-39215)
Vulnerability from nvd – Published: 2022-09-15 21:35 – Updated: 2025-04-22 17:21
VLAI
EPSS
VEX
Title
The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
Summary
Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:39 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/issues/4882 | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/pull/5123 | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/pull/5123/com… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
< 1.0.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:00:42.497Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/issues/4882"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-39215",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:39:32.741893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T17:21:33.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-15T21:35:11.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/issues/4882"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678"
}
],
"source": {
"advisory": "GHSA-28m8-9j7v-x499",
"discovery": "UNKNOWN"
},
"title": "The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-39215",
"STATE": "PUBLIC",
"TITLE": "The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "tauri",
"version": {
"version_data": [
{
"version_value": "\u003c 1.0.6"
}
]
}
}
]
},
"vendor_name": "tauri-apps"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499",
"refsource": "CONFIRM",
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499"
},
{
"name": "https://github.com/tauri-apps/tauri/issues/4882",
"refsource": "MISC",
"url": "https://github.com/tauri-apps/tauri/issues/4882"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/5123",
"refsource": "MISC",
"url": "https://github.com/tauri-apps/tauri/pull/5123"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678",
"refsource": "MISC",
"url": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678"
}
]
},
"source": {
"advisory": "GHSA-28m8-9j7v-x499",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-39215",
"datePublished": "2022-09-15T21:35:11.000Z",
"dateReserved": "2022-09-02T00:00:00.000Z",
"dateUpdated": "2025-04-22T17:21:33.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-95627 (GCVE-0-2026-95627)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:43 – Updated: 2026-09-23 14:22
VLAI
EPSS
VEX
Title
Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion
Summary
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:21 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | issue-tracking |
| https://github.com/tauri-apps/plugins-workspace | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-dialog |
Affected:
2.0.0 , ≤ *
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:21:31.658846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:22:55.260Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-dialog",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-dialog",
"product": "tauri-plugin-dialog",
"programFiles": [
"plugins/dialog/src/commands.rs"
],
"repo": "git://github.com/tauri-apps/plugins-workspace",
"vendor": "Tauri",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen a Tauri application uses the dialog plugin\u0027s file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.\u003c/p\u003e"
}
],
"value": "When a Tauri application uses the dialog plugin\u0027s file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Script in the webview gets read and write access to a whole directory tree, after one click on a dialog that looked completely normal. Aim it at the home folder and that is everything the user owns. The script does not need any privileges of its own to ask; an XSS in content the app renders is enough."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:43:04.542Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-vw89-89jm-wmqc (tauri-apps/plugins-workspace)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-vw89-89jm-wmqc"
},
{
"name": "tauri-apps/plugins-workspace repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/plugins-workspace"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThe fix is to stop taking the recursion flag from the caller. Grant what was actually chosen: the one file, or the one folder and nothing below it. An app that genuinely needs a recursive grant can ask for one in its own Rust code, where the frontend cannot reach it.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "The fix is to stop taking the recursion flag from the caller. Grant what was actually chosen: the one file, or the one folder and nothing below it. An app that genuinely needs a recursive grant can ask for one in its own Rust code, where the frontend cannot reach it."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-28T08:23:00.000Z",
"value": "Reported to the Tauri team as GHSA-vw89-89jm-wmqc"
}
],
"title": "Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95627",
"datePublished": "2026-09-23T09:43:04.542Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-23T14:22:55.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95626 (GCVE-0-2026-95626)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:33 – Updated: 2026-09-23 14:03
VLAI
EPSS
VEX
Title
Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
Summary
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:03 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | issue-tracking |
| https://github.com/tauri-apps/tauri | product |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95626",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:03:10.553800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:03:18.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri",
"defaultStatus": "unaffected",
"packageName": "tauri",
"product": "tauri",
"programFiles": [
"crates/tauri-utils/src/html.rs",
"crates/tauri/src/manager/mod.rs"
],
"repo": "git://github.com/tauri-apps/tauri",
"vendor": "Tauri",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTauri\u0027s Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Tauri\u0027s Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:33:09.366Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-6vxm-x265-58qf (tauri-apps/tauri)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6vxm-x265-58qf"
},
{
"name": "tauri-apps/tauri repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/tauri"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-17T16:46:00.000Z",
"value": "Reported to the Tauri team as GHSA-6vxm-x265-58qf"
}
],
"title": "Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95626",
"datePublished": "2026-09-23T09:33:09.366Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-23T14:03:18.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95625 (GCVE-0-2026-95625)
Vulnerability from cvelistv5 – Published: 2026-09-23 08:51 – Updated: 2026-09-23 14:10
VLAI
EPSS
VEX
Title
Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
Summary
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:07 UTC
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | issue-tracking |
| https://github.com/tauri-apps/plugins-workspace | product |
| https://github.com/tauri-apps/plugins-workspace/c… | patch |
| https://github.com/tauri-apps/plugins-workspace/r… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-updater |
Affected:
2.0.0 , < 2.12.0
(semver)
Affected: 2.12.0 , ≤ * (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:07:42.715205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:10:35.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-updater",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-updater",
"product": "tauri-plugin-updater",
"programFiles": [
"plugins/updater/src/updater.rs",
"plugins/updater/src/config.rs"
],
"repo": "git://github.com/tauri-apps/plugins-workspace",
"vendor": "Tauri",
"versions": [
{
"lessThan": "2.12.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest\u0027s version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer\u0027s private key.\u003c/p\u003e"
}
],
"value": "The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest\u0027s version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer\u0027s private key."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T08:51:53.922Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-j38x-g3m3-95fr (tauri-apps/plugins-workspace)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-j38x-g3m3-95fr"
},
{
"name": "tauri-apps/plugins-workspace repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/plugins-workspace"
},
{
"name": "Add requireSignedVersion to bind an update to its signed version",
"tags": [
"patch"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/690dcfd694"
},
{
"name": "tauri-plugin-updater 2.12.0 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eaddressed in tauri-plugin-updater 2.12.0, and it has to be switched on. The new requireSignedVersion option compares the version announced by the endpoint against the version recorded in the signature\u0027s trusted comment, which the signature does cover, and rejects the update when they differ.\u003c/p\u003e"
}
],
"value": "addressed in tauri-plugin-updater 2.12.0, and it has to be switched on. The new requireSignedVersion option compares the version announced by the endpoint against the version recorded in the signature\u0027s trusted comment, which the signature does cover, and rejects the update when they differ."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-01T13:31:00.000Z",
"value": "Reported to the Tauri team as GHSA-j38x-g3m3-95fr"
},
{
"lang": "en",
"time": "2026-09-19T23:57:00.000Z",
"value": "Opt-in fix released in tauri-plugin-updater 2.12.0, commit 690dcfd694, adding the requireSignedVersion option"
}
],
"title": "Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95625",
"datePublished": "2026-09-23T08:51:53.922Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-23T14:10:35.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95624 (GCVE-0-2026-95624)
Vulnerability from cvelistv5 – Published: 2026-09-22 17:16 – Updated: 2026-09-22 19:30
VLAI
EPSS
VEX
Title
Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
Summary
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 19:30 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | issue-tracking |
| https://github.com/tauri-apps/tauri | product |
| https://github.com/tauri-apps/plugins-workspace/c… | patch |
| https://github.com/tauri-apps/plugins-workspace/r… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-updater |
Affected:
2.8.0 , < 2.12.0
(semver)
|
Date Public
2026-09-23 10:14
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T19:30:03.565802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:30:22.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-updater",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-updater",
"product": "tauri-plugin-updater",
"programFiles": [
"plugins/updater/src/commands.rs",
"plugins/updater/src/config.rs"
],
"repo": "git://github.com/tauri-apps/tauri",
"vendor": "Tauri",
"versions": [
{
"lessThan": "2.12.0",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"datePublic": "2026-09-23T10:14:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Tauri updater plugin\u0027s \u0027check\u0027 IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from \"update must be newer\" to \"update must be different.\" Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.\u003c/p\u003e"
}
],
"value": "The Tauri updater plugin\u0027s \u0027check\u0027 IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from \"update must be newer\" to \"update must be different.\" Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:16:25.195Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-rjc6-5hfg-grp9 (tauri-apps/tauri)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-rjc6-5hfg-grp9"
},
{
"name": "tauri-apps/tauri repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/tauri"
},
{
"name": "Move allowDowngrades from the check command to the plugin configuration",
"tags": [
"patch"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/1308bfa399b962b3977c767100a6339d1cbfdd20"
},
{
"name": "tauri-plugin-updater 2.12.0 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFixed in tauri-plugin-updater 2.12.0. allowDowngrades was removed from the check command and is now read from the plugin configuration instead, where the frontend cannot reach it, and it defaults to false. An application that provides its own version comparator still takes precedence.\u003c/p\u003e"
}
],
"value": "Fixed in tauri-plugin-updater 2.12.0. allowDowngrades was removed from the check command and is now read from the plugin configuration instead, where the frontend cannot reach it, and it defaults to false. An application that provides its own version comparator still takes precedence."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-25T09:40:00.000Z",
"value": "Reported to the Tauri team as GHSA-rjc6-5hfg-grp9"
},
{
"lang": "en",
"time": "2026-09-20T00:00:00.000Z",
"value": "Fixed in tauri-plugin-updater 2.12.0, commit 1308bfa399, by moving allowDowngrades out of the IPC command and into the plugin configuration"
}
],
"title": "Tauri framework v2 malicious downgrade via allow_downgrades from frontend code",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95624",
"datePublished": "2026-09-22T17:16:25.195Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-22T19:30:22.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95623 (GCVE-0-2026-95623)
Vulnerability from cvelistv5 – Published: 2026-09-22 10:52 – Updated: 2026-09-22 17:17
VLAI
EPSS
VEX
Title
Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
Summary
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 12:28 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | issue-tracking |
| https://github.com/tauri-apps/plugins-workspace | product |
| https://github.com/tauri-apps/plugins-workspace/c… | patch |
| https://github.com/tauri-apps/plugins-workspace/r… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tauri | tauri-plugin-http |
Affected:
2.0.0 , ≤ 2.6.1
(semver)
Affected: 2.7.0 , ≤ * (semver) |
Date Public
2026-09-23 10:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T12:28:50.708719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T12:28:59.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://crates.io/crates/tauri-plugin-http",
"defaultStatus": "unaffected",
"packageName": "tauri-plugin-http",
"product": "tauri-plugin-http",
"programFiles": [
"plugins/http/src/commands.rs",
"plugins/http/src/scope.rs",
"plugins/http/src/config.rs"
],
"repo": "git://github.com/tauri-apps/plugins-workspace",
"vendor": "Tauri",
"versions": [
{
"lessThanOrEqual": "2.6.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVersions 2.0.0 through 2.6.1 are affected in every configuration and no fix is available for them. From 2.7.0 the plugin can check the scope on each redirect hop, but only when the application sets the scopeRedirects option in its http plugin configuration. A 2.7.0 or later application that does not set it behaves as before and is still affected.\u003c/p\u003e"
}
],
"value": "Versions 2.0.0 through 2.6.1 are affected in every configuration and no fix is available for them. From 2.7.0 the plugin can check the scope on each redirect hop, but only when the application sets the scopeRedirects option in its http plugin configuration. A 2.7.0 or later application that does not set it behaves as before and is still affected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick"
},
{
"lang": "en",
"type": "coordinator",
"value": "JFrog Security Research"
}
],
"datePublic": "2026-09-23T10:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Tauri HTTP plugin validates requested URLs against the application\u0027s configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.\u003c/p\u003e"
}
],
"value": "The Tauri HTTP plugin validates requested URLs against the application\u0027s configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Requests the frontend starts reach hosts the scope was written to exclude, and the answer is handed back to it. Internal services and cloud metadata endpoints are the obvious targets."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T17:17:16.133Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "GHSA-2rxp-f4w5-6hjr (tauri-apps/plugins-workspace)",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-2rxp-f4w5-6hjr"
},
{
"name": "tauri-apps/plugins-workspace repository",
"tags": [
"product"
],
"url": "https://github.com/tauri-apps/plugins-workspace"
},
{
"name": "Check the URL scope on every hop of a redirect chain",
"tags": [
"patch"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/1198a524b710abf2abeb1d9bd7b252402d26ca6d"
},
{
"name": "tauri-plugin-http 2.7.0 release notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tauri-apps/plugins-workspace/releases/tag/http-v2.7.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to tauri-plugin-http 2.7.0 or later and turn on the new scopeRedirects option. Both steps are needed. The fix is opt-in, so 2.7.0 on its own still follows a redirect out of scope; the option is what makes the plugin check every hop. Tauri made it opt-in because a redirect that leaves the scope now fails, which changes behaviour for apps that were relying on it.\u003c/p\u003e\u003ccode\u003e {\u0026quot;plugins\u0026quot;: {\u0026quot;http\u0026quot;: {\u0026quot;scopeRedirects\u0026quot;: true}}}\u003c/code\u003e\u003cbr/\u003e\u003cp\u003eNothing in the 2.0.0 to 2.6.1 range has a fix available.\u003c/p\u003e"
}
],
"value": "Upgrade to tauri-plugin-http 2.7.0 or later and turn on the new scopeRedirects option. Both steps are needed. The fix is opt-in, so 2.7.0 on its own still follows a redirect out of scope; the option is what makes the plugin check every hop. Tauri made it opt-in because a redirect that leaves the scope now fails, which changes behaviour for apps that were relying on it.\n\n {\"plugins\": {\"http\": {\"scopeRedirects\": true}}}\n\n\nNothing in the 2.0.0 to 2.6.1 range has a fix available."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-28T08:24:00.000Z",
"value": "Reported to the Tauri team as GHSA-2rxp-f4w5-6hjr"
},
{
"lang": "en",
"time": "2026-09-20T00:01:00.000Z",
"value": "Opt-in fix released in tauri-plugin-http 2.7.0, commit 1198a524, adding the scopeRedirects option"
}
],
"title": "Tauri framework v2 SSRF Protection Bypass via HTTP Redirects",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-95623",
"datePublished": "2026-09-22T10:52:20.006Z",
"dateReserved": "2026-09-22T10:38:03.883Z",
"dateUpdated": "2026-09-22T17:17:16.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42184 (GCVE-0-2026-42184)
Vulnerability from cvelistv5 – Published: 2026-05-27 14:29 – Updated: 2026-05-27 15:40
VLAI
EPSS
VEX
Title
Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
Summary
Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-27 15:39 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 2.0, < 2.11.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42184",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T15:39:47.892764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T15:40:09.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0, \u003c 2.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri\u0027s is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://\u003cscheme\u003e.localhost/ because those platforms\u0027 WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri\u0027s check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T14:29:53.825Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9"
}
],
"source": {
"advisory": "GHSA-7gmj-67g7-phm9",
"discovery": "UNKNOWN"
},
"title": "Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42184",
"datePublished": "2026-05-27T14:29:53.825Z",
"dateReserved": "2026-04-25T01:53:21.583Z",
"dateUpdated": "2026-05-27T15:40:09.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-31477 (GCVE-0-2025-31477)
Vulnerability from cvelistv5 – Published: 2025-04-02 21:10 – Updated: 2025-04-03 13:59
VLAI
EPSS
VEX
Title
Improper Scope Validation in the open Endpoint of tauri-plugin-shell
Summary
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-03 13:58 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/plugins-workspace/s… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/plugins-workspace/c… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | plugins-workspace |
Affected:
< 2.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-31477",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T13:58:49.532045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T13:59:36.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "plugins-workspace",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-02T21:10:14.264Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp"
},
{
"name": "https://github.com/tauri-apps/plugins-workspace/commit/9cf0390a52497e273db1a1b613a0e26827aa327c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/plugins-workspace/commit/9cf0390a52497e273db1a1b613a0e26827aa327c"
}
],
"source": {
"advisory": "GHSA-c9pr-q8gx-3mgp",
"discovery": "UNKNOWN"
},
"title": "Improper Scope Validation in the open Endpoint of tauri-plugin-shell"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-31477",
"datePublished": "2025-04-02T21:10:14.264Z",
"dateReserved": "2025-03-28T13:36:51.297Z",
"dateUpdated": "2025-04-03T13:59:36.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-46115 (GCVE-0-2023-46115)
Vulnerability from cvelistv5 – Published: 2023-10-19 23:35 – Updated: 2024-09-12 15:50
VLAI
EPSS
VEX
Title
Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Summary
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: ['VITE_', 'TAURI_'],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: ['VITE_'],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
Severity
8.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-12 15:50 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://tauri.app/v1/guides/getting-started/setup/vite/ | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 2.0.0-alpha.0, < 2.0.0-alpha.16
Affected: >= 1.0.0, < 1.5.6 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:37:39.516Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259"
},
{
"name": "https://tauri.app/v1/guides/getting-started/setup/vite/",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tauri.app/v1/guides/getting-started/setup/vite/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-46115",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T15:50:11.390191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T15:50:32.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0-alpha.0, \u003c 2.0.0-alpha.16"
},
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.5.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: [\u0027VITE_\u0027, \u0027TAURI_\u0027],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: [\u0027VITE_\u0027],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI \u003e=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater\u0027s `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-19T19:07:53.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259"
},
{
"name": "https://tauri.app/v1/guides/getting-started/setup/vite/",
"tags": [
"x_refsource_MISC"
],
"url": "https://tauri.app/v1/guides/getting-started/setup/vite/"
}
],
"source": {
"advisory": "GHSA-2rcp-jvr4-r259",
"discovery": "UNKNOWN"
},
"title": "Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-46115",
"datePublished": "2023-10-19T23:35:03.875Z",
"dateReserved": "2023-10-16T17:51:35.570Z",
"dateUpdated": "2024-09-12T15:50:32.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-34460 (GCVE-0-2023-34460)
Vulnerability from cvelistv5 – Published: 2023-06-23 19:09 – Updated: 2024-11-07 19:04
VLAI
EPSS
VEX
Title
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Summary
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-07 19:03 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/pull/6969#dis… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/pull/7227 | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/commit/066c09… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
= 1.4.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:10:07.301Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/7227",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/7227"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-34460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T19:03:47.667794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T19:04:00.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "= 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-23T19:09:54.173Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/7227",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/7227"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564"
}
],
"source": {
"advisory": "GHSA-wmff-grcw-jcfm",
"discovery": "UNKNOWN"
},
"title": "Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-34460",
"datePublished": "2023-06-23T19:09:54.173Z",
"dateReserved": "2023-06-06T16:16:53.559Z",
"dateUpdated": "2024-11-07T19:04:00.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31134 (GCVE-0-2023-31134)
Vulnerability from cvelistv5 – Published: 2023-05-09 13:09 – Updated: 2025-01-28 17:29
VLAI
EPSS
VEX
Title
Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Summary
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit
arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-28 17:29 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/releases/tag/… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/releases/tag/… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/releases/tag/… | x_refsource_MISC |
| https://www.github.com/tauri-apps/tauri/commit/58… | x_refsource_MISC |
| https://www.github.com/tauri-apps/tauri/commit/fa… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 1.0.0, < 1.0.9
Affected: >= 1.1.0, < 1.1.4 Affected: >= 1.2.0, < 1.2.5 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:45:25.822Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-28T17:29:36.104500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-28T17:29:46.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.9"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.4"
},
{
"status": "affected",
"version": "\u003e= 1.2.0, \u003c 1.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit\narbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-09T13:09:31.399Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4"
},
{
"name": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767"
},
{
"name": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f"
}
],
"source": {
"advisory": "GHSA-4wm2-cwcf-wwvp",
"discovery": "UNKNOWN"
},
"title": "Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-31134",
"datePublished": "2023-05-09T13:09:31.399Z",
"dateReserved": "2023-04-24T21:44:10.416Z",
"dateUpdated": "2025-01-28T17:29:46.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-46171 (GCVE-0-2022-46171)
Vulnerability from cvelistv5 – Published: 2022-12-23 13:47 – Updated: 2025-04-15 03:17
VLAI
EPSS
VEX
Title
Tauri vulnerable to path traversal
Summary
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-15 03:14 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/commit/72389b… | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/commit/f0602e… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 1.0.0, < 1.0.8
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0, < 1.2.3 Affected: >= 2.0.0-alpha.0, < 2.0.0-alpha.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T14:24:03.235Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-46171",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-15T03:14:09.148755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T03:17:21.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.8"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0, \u003c 1.2.3"
},
{
"status": "affected",
"version": "\u003e= 2.0.0-alpha.0, \u003c 2.0.0-alpha.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-23T13:47:56.494Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3"
},
{
"name": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58"
}
],
"source": {
"advisory": "GHSA-6mv3-wm7j-h4w5",
"discovery": "UNKNOWN"
},
"title": "Tauri vulnerable to path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-46171",
"datePublished": "2022-12-23T13:47:56.494Z",
"dateReserved": "2022-11-28T17:27:19.998Z",
"dateUpdated": "2025-04-15T03:17:21.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41874 (GCVE-0-2022-41874)
Vulnerability from cvelistv5 – Published: 2022-11-10 00:00 – Updated: 2025-04-23 16:38
VLAI
EPSS
VEX
Title
Tauri Filesystem Scope can be Partially Bypassed
Summary
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 13:54 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
>= 1.0.0, <1.0.7
Affected: >= 1.1.0, <1.1.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-q9wv-22m9-vhqh"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41874",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:54:51.769199Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T16:38:40.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c1.0.7"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c1.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-10T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-q9wv-22m9-vhqh"
}
],
"source": {
"advisory": "GHSA-q9wv-22m9-vhqh",
"discovery": "UNKNOWN"
},
"title": "Tauri Filesystem Scope can be Partially Bypassed"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41874",
"datePublished": "2022-11-10T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-23T16:38:40.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-39215 (GCVE-0-2022-39215)
Vulnerability from cvelistv5 – Published: 2022-09-15 21:35 – Updated: 2025-04-22 17:21
VLAI
EPSS
VEX
Title
The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
Summary
Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:39 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tauri-apps/tauri/security/advi… | x_refsource_CONFIRM |
| https://github.com/tauri-apps/tauri/issues/4882 | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/pull/5123 | x_refsource_MISC |
| https://github.com/tauri-apps/tauri/pull/5123/com… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tauri-apps | tauri |
Affected:
< 1.0.6
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:00:42.497Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/issues/4882"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-39215",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:39:32.741893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T17:21:33.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tauri",
"vendor": "tauri-apps",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-15T21:35:11.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/issues/4882"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678"
}
],
"source": {
"advisory": "GHSA-28m8-9j7v-x499",
"discovery": "UNKNOWN"
},
"title": "The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-39215",
"STATE": "PUBLIC",
"TITLE": "The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "tauri",
"version": {
"version_data": [
{
"version_value": "\u003c 1.0.6"
}
]
}
}
]
},
"vendor_name": "tauri-apps"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499",
"refsource": "CONFIRM",
"url": "https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499"
},
{
"name": "https://github.com/tauri-apps/tauri/issues/4882",
"refsource": "MISC",
"url": "https://github.com/tauri-apps/tauri/issues/4882"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/5123",
"refsource": "MISC",
"url": "https://github.com/tauri-apps/tauri/pull/5123"
},
{
"name": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678",
"refsource": "MISC",
"url": "https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678"
}
]
},
"source": {
"advisory": "GHSA-28m8-9j7v-x499",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-39215",
"datePublished": "2022-09-15T21:35:11.000Z",
"dateReserved": "2022-09-02T00:00:00.000Z",
"dateUpdated": "2025-04-22T17:21:33.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}