Read the docs
TI-2026-30506 Aliases CVE-2026-42184GHSA-7gmj-67g7-phm9

Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands

Priority MEDIUM 60CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tauri (tauri-apps): 2.11.1tauri (crates.io): 2.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tauri-appstauri2.0 to before 2.11.12.11.1Patch availableCNA
—tauri (crates.io)2.0.0 to before 2.11.12.11.1Patch availableGHSA-7gmj-67g7-phm9
  • tauri Vendortauri-apps Affected 2.0 to before 2.11.1 Fixed in 2.11.1 Patch available CNA
  • tauri (crates.io) Vendor— Affected 2.0.0 to before 2.11.1 Fixed in 2.11.1 Patch available GHSA-7gmj-67g7-phm9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:*2.0.0 to before 2.10.3Vulnerabletauri-apps
  • cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.10.3 Vulnerable ·tauri-apps

Remediation

  • Fix · CNA tauri (tauri-apps) Fixed in 2.11.1
  • Fix · GHSA-7gmj-67g7-phm9 tauri (crates.io) Fixed in 2.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42184
  2. 2026-10-03 Alias added: GHSA-7gmj-67g7-phm9

References

Exploit 1

Advisory 1

Other 1

  • TI-2022-18594 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri CVSS 3.1HIGH 8.3
  • TI-2023-24757 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli CVSS 3.1HIGH 8.4
  • TI-2022-22815 Tauri vulnerable to path traversal CVSS 3.1HIGH 7.7
  • TI-2023-17285 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles CVSS 3.1CRITICAL 9.8
  • TI-2023-14844 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites CVSS 3.1MEDIUM 5.4
  • TI-2022-20215 Tauri Filesystem Scope can be Partially Bypassed CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences