tauri-apps @tauri-apps/plugin-shell vulnerabilities

Latest tauri-apps @tauri-apps/plugin-shell CVEs

Newest publication first

1. CVE-2025-31477 Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

   Critical·CVSS 9.3

   Impact The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.