Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A flaw in Tauri's islocalurl() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application (e.g. http://app.attacker.com/)." Example: - Local URL: app://localhost/ → on Android/Windows: http://app.localhost/ - The check passes for any URL starting with http://app., including http://app.evil.com/ As a result, the attacker page can invoke backend commands that the developer intended to be accessible only to the app's own frontend and that are explicitly restricted from being called by external or remote origins. Details Vulnerable function:…
Recommended action: Upgrade to 2.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. This bypasses the origin check and allows iFrames to access the IPC endpoints exposed to the parent window. For this to be exploitable, an attacker must have script execution (e.g. XSS) in a script-enabled iFrame of a Tauri application. Patches The patches include changes to wry and the behaviour of Tauri applications using iFrames. Previously, we injected the Tauri IPC initialization script into iFrames on MacOS, which was unintended. This is now also disabled to be consistent with all other supported operating systems. This means that the Tauri invoke functionality is no longer accessible from iFrames, except on Windows when the origin of the Tauri window and the origin of the iFrame are the same. We have also added a new protection mechanism to the IPC layer to protect against iFrames…
Recommended action: Upgrade to 2.0.0-beta.20 (pre-release) or 1.6.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The 1.4.0 release includes a regression on the filesystem scope check for dotfiles on Linux and macOS. Previously dotfiles (eg. $HOME/.ssh/) were not implicitly allowed by the glob wildcard scopes (eg. $HOME/), but a regression was introduced when a configuration option for this behavior was implemented and dotfiles were implicitly allowed. Only Tauri applications using wildcard scopes in the fs endpoint are affected. Only macOS and Linux systems are affected. Patches The regression has been patched on v1.4.1. Workarounds There are no known workarounds at this time, users should update to v1.4.1 immediately. References See the original advisory for more information. For more Information If you have any questions or comments about this advisory: Open an issue in tauri Email us at security@tauri.app
Recommended action: Upgrade to 1.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The Tauri IPC is usually strictly isolated from external websites but the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect[^open-redirect]. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. Patches This issue has been patched in the latest release and was backported to all previous 1.x releases. Workarounds Prevent arbitrary input in redirect features. Only allow trusted websites access to the IPC. References The feature to enable this behavior in a more constrained way was introduced in the 1.3 release and documentation around this can be found in the documentation. [^open-redirect]: https://en.wikipedia.org/wiki/Openredirect
Recommended action: Upgrade to 1.2.5, 1.1.4 or 1.0.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1.2.31.0.82.0.0-alpha.21.1.3· Vendor fix available
Issue
Impact The filesystem glob pattern wildcards , ?, and [...] match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Example: The fs scope $HOME/.key would also allow $HOME/.ssh/secret.key to be read even though it is in a sub directory of $HOME and is inside a hidden folder. Scopes without the wildcards are not affected. As allows for sub directories the behavior there is also as expected. Patches The issue has been patched in the latest release and was backported into the currently supported 1.x branches. Workarounds No workaround is known at the time of publication. References The original report contained information that the dialog.open component automatically allows one sub directory to be read, regardless of the recursive option. Imagine a file system looking like Reproduction steps: 1. Trying to load “file.txt” or “deepfile.txt” doesn’t work. Expected 2. Select “documents” as folder to open(ie. with…
Recommended action: Upgrade to 2.0.0-alpha.2 (pre-release), 1.2.3, 1.1.3 or 1.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to missing canonicalization when readDir is called recursively, it was possible to display directory listings outside of the defined fs scope. This required a crafted symbolic link or junction folder inside an allowed path of the fs scope. No arbitrary file content could be leaked. Patches The issue has been resolved in https://github.com/tauri-apps/tauri/pull/5123 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined scope. Workarounds Disable the readDir endpoint in the allowlist inside the tauri.conf.json. For more information This issue was initially reported by martin-ocasek in #4882. If you have any questions or comments about this advisory: Open an issue in tauri Email us at security@tauri.app
Recommended action: Upgrade to 1.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.