TI-2025-22658 CVE-2025-31477 · GHSA-c9pr-q8gx-3mgp
Improper Scope Validation in the open Endpoint of tauri-plugin-shell
Priority HIGH 81
The Tauri shell plugin allows access to the system shell.
tauri-apps
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
tauri-apps records in CISA KEVNo tauri-apps vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2022-18594 CVE-2022-39215 · GHSA-28m8-9j7v-x499
The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
Priority HIGH 75
Tauri is a framework for building binaries for all major desktop platforms.
TI-2023-24757 CVE-2023-46115 · GHSA-2rcp-jvr4-r259
Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Priority HIGH 70
Tauri is a framework for building binaries for all major desktop platforms.
TI-2022-22815 CVE-2022-46171 · GHSA-6mv3-wm7j-h4w5
Tauri vulnerable to path traversal
Priority HIGH 67
Tauri is a framework for building binaries for all major desktop platforms.
TI-2026-30506 CVE-2026-42184 · GHSA-7gmj-67g7-phm9
Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
Priority MEDIUM 60
Tauri is a framework for building binaries for all major desktop platforms.
TI-2024-23292 CVE-2024-35222 · GHSA-57fm-592m-34r7
iFrames Bypass Origin Checks for Tauri API Access Control
Priority MEDIUM 60
Tauri is a framework for building binaries for all major desktop platforms.
TI-2023-17285 CVE-2023-34460 · GHSA-wmff-grcw-jcfm
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Priority MEDIUM 43
Tauri is a framework for building binaries for all major desktop platforms.
TI-2026-63659 CVE-2026-95626 · GHSA-757j-xrg3-9g6p
Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
Priority LOW 38
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive.
TI-2026-63660 CVE-2026-95627 · GHSA-j8fp-v6pf-qx45
Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion
Priority LOW 36
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree a…
TI-2026-63657 CVE-2026-95624 · GHSA-wqjv-7vqv-x3mj
Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
Priority LOW 32
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code.
TI-2026-63658 CVE-2026-95625 · GHSA-p8c6-29q6-cqw7
Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
Priority LOW 27
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes.
TI-2026-63656 CVE-2026-95623 · GHSA-5gm7-pf8v-vxwc
Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
Priority LOW 25
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request.
TI-2023-14844 CVE-2023-31134 · GHSA-4wm2-cwcf-wwvp
Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Priority LOW 25
Tauri is software for building applications for multi-platform deployment.
TI-2022-20215 CVE-2022-41874 · GHSA-q9wv-22m9-vhqh
Tauri Filesystem Scope can be Partially Bypassed
Priority LOW 22
Tauri is a framework for building binaries for all major desktop platforms.