tauri-apps vulnerabilities

Products

• tauri 8
• @tauri-apps/cli 1
• @tauri-apps/plugin-shell 1
• plugins-workspace 1

Latest tauri-apps CVEs

Newest publication first

1. CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands

   Published 2026-05-27

   Medium·CVSS 6.1 EPSS 0.31%

   Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme...

2. CVE-2025-31477 Improper Scope Validation in the open Endpoint of tauri-plugin-shell

   Published 2025-04-02

   Critical·CVSS 9.3 EPSS 1.0%

   The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open o...

3. CVE-2024-35222 iFrames Bypass Origin Checks for Tauri API Access Control

   Published 2024-05-23

   Medium·CVSS 5.9 EPSS 0.35%

   Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands wi...

4. CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

   Published 2023-10-19

   Medium·CVSS 5.5 EPSS 0.20%

   Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Taur...

5. CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles

   Published 2023-06-23

   Critical·CVSS 9.8 EPSS 0.65%

   Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. $HOME/*), but a regression was...

6. CVE-2023-31134 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

   Published 2023-05-09

   Medium·CVSS 5.4 EPSS 0.52%

   Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Taur...

7. CVE-2022-46171 Tauri vulnerable to path traversal

   Published 2022-12-23

   High·CVSS 7.7 EPSS 1.1%

   Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards *, ?, and [...] match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards...

8. CVE-2022-41874 Tauri Filesystem Scope can be Partially Bypassed

   Published 2022-11-10

   Medium·CVSS 4.7 EPSS 0.52%

   Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functiona...

9. CVE-2022-39215 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri

   Published 2022-09-15

   Medium·CVSS 5.8 EPSS 1.0%

   Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when readDir is called recursively, it was possible to display directory listings outside of the defined fs scope. This required a crafted symbolic link or junction folder...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.