Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion
Priority LOW 36CWE-732Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tauri-apps | tauri-plugin-dialog | 2.0.0 and later | — | No fix listed | CNA |
- tauri-plugin-dialog Vendortauri-apps Affected 2.0.0 and later Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-95627
- 2026-10-03 Alias added: GHSA-j8fp-v6pf-qx45
References
More tauri-apps vulnerabilities
- TI-2025-22658 Improper Scope Validation in the open Endpoint of tauri-plugin-shell CVSS 4.0CRITICAL 9.3
- TI-2022-18594 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri CVSS 3.1HIGH 8.3
- TI-2023-24757 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli CVSS 3.1HIGH 8.4
- TI-2022-22815 Tauri vulnerable to path traversal CVSS 3.1HIGH 7.7
- TI-2026-30506 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands CVSS 4.0MEDIUM 6.1
- TI-2024-23292 iFrames Bypass Origin Checks for Tauri API Access Control CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-95627 · CVE Program
- CVE-2026-95627 · NVD
- FIRST EPSS
- GHSA-j8fp-v6pf-qx45 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences