Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

tauri

8 known vulnerabilities (2 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 5 medium, 1 low
Weekly downloads
1.3M
Dependents
0
Registry
crates.io

Advisories 8

  • Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

    Affected: from 2.0.0.

  • CVE-2026-42184Medium 6.1

    Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands

    Affected: from 2.0.0, fixed in 2.11.1.

  • CVE-2024-35222Medium 5.9

    iFrames Bypass Origin Checks for Tauri API Access Control

    Affected: fixed in 1.6.7; from 2.0.0-beta.0, fixed in 2.0.0-beta.20.

  • CVE-2023-34460Medium 4.8

    Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles

    Affected: from 1.4.0, fixed in 1.4.1.

  • CVE-2023-31134Medium 4.8

    Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

    Affected: from 1.0.0, fixed in 1.0.9; from 1.1.0, fixed in 1.1.4; from 1.2.0, fixed in 1.2.5.

  • CVE-2022-46171Medium 6.8

    Tauri vulnerable to path traversal

    Affected: from 1.0.0, fixed in 1.0.8; from 1.1.0, fixed in 1.1.3; from 1.2.0, fixed in 1.2.3; from 2.0.0-alpha.0, fixed in 2.0.0-alpha.2.

  • Tauri Filesystem Scope can be Partially Bypassed

    Affected: from 1.0.0, fixed in 1.0.7; from 1.1.0, fixed in 1.1.2; from 1.0.0, fixed in 1.0.7; from 1.1.0, fixed in 1.1.2.

  • The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri

    Affected: fixed in 1.0.6; fixed in 1.0.6.