Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tauri-apps | tauri | = 1.4.0 | — | No fix listed | CNA |
| — | tauri (crates.io) | 1.4.0 to before 1.4.1 | 1.4.1 | Patch available | GHSA-wmff-grcw-jcfm |
- tauri Vendortauri-apps Affected = 1.4.0 Fixed in — No fix listed CNA
- tauri (crates.io) Vendor— Affected 1.4.0 to before 1.4.1 Fixed in 1.4.1 Patch available GHSA-wmff-grcw-jcfm
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tauri:tauri:1.4.0:*:*:*:*:*:*:* | 1.4.0 | Vulnerable | tauri-apps |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:tauri:tauri:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·tauri-apps
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
- Fix · GHSA-wmff-grcw-jcfm tauri (crates.io) Fixed in 1.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34460
- 2026-10-03 Alias added: GHSA-wmff-grcw-jcfm
- 2026-10-18 EPSS moved to the 50th–90th percentile
References
Patch 3
Advisory 2
More tauri-apps Tauri vulnerabilities
- TI-2022-18594 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri CVSS 3.1HIGH 8.3
- TI-2023-24757 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli CVSS 3.1HIGH 8.4
- TI-2022-22815 Tauri vulnerable to path traversal CVSS 3.1HIGH 7.7
- TI-2026-30506 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands CVSS 4.0MEDIUM 6.1
- TI-2023-14844 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites CVSS 3.1MEDIUM 5.4
- TI-2022-20215 Tauri Filesystem Scope can be Partially Bypassed CVSS 3.1MEDIUM 4.7
Sources
- CVE-2023-34460 · CVE Program
- CVE-2023-34460 · NVD
- FIRST EPSS
- GHSA-wmff-grcw-jcfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences