Priority LOW 36
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree a…
CVSS 3.1HIGH 7.7· Network · Low privileges · User interaction · EPSS 0.00338 · Published 2026-09-23 · No fix listed CWE-732
Priority LOW 38
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.00471 · Published 2026-09-23 · No fix listed CWE-79
Priority LOW 27
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes.
CVSS 3.1MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.00156 · Published 2026-09-23 · No fix listed CWE-354
Priority LOW 32
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code.
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00449 · Published 2026-09-22 · Fixed in 2.12.0 CWE-284
Priority LOW 25
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request.
CVSS 3.1MEDIUM 5.6· Adjacent network · No auth · User interaction · EPSS 0.00238 · Published 2026-09-22 · No fix listed CWE-918
Priority MEDIUM 60
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 4.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00312 · Published 2026-05-27 · Fixed in 2.11.1 CWE-918
Priority HIGH 81
The Tauri shell plugin allows access to the system shell.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.01039 · Published 2025-04-02 · Fixed in 2.2.1 CWE-20
Priority MEDIUM 60
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · User interaction · EPSS 0.00349 · Published 2024-05-23 · Fixed in 1.6.7, 2.0.0-beta.20 CWE-284
Priority HIGH 70
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 3.1HIGH 8.4· Local · Low privileges · No interaction · EPSS 0.00204 · Published 2023-10-19 · Fixed in 2.0.0-alpha.16, 1.5.6 CWE-200
Priority MEDIUM 43
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00647 · Published 2023-06-23 · Fixed in 1.4.1 CWE-285
Priority LOW 25
Tauri is software for building applications for multi-platform deployment.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00524 · Published 2023-05-09 · Fixed in 1.0.9, 1.1.4 +1 CWE-601
Priority HIGH 67
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01073 · Published 2022-12-23 · Fixed in 1.0.8, 1.1.3 +2 CWE-22
Priority LOW 22
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00516 · Published 2022-11-10 · Fixed in 1.0.7, 1.1.2 CWE-668
Priority HIGH 75
Tauri is a framework for building binaries for all major desktop platforms.
CVSS 3.1HIGH 8.3· Network · No auth · No interaction · EPSS 0.01022 · Published 2022-09-15 · Fixed in 1.0.6 CWE-22
THREATIST.IORead the docs