5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
26.5%
Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit
arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.
CPE | Name | Operator | Version |
---|---|---|---|
tauri:tauri | tauri | lt | 1.0.9 |
tauri:tauri | tauri | lt | 1.1.4 |
tauri:tauri | tauri | lt | 1.2.5 |
[
{
"vendor": "tauri-apps",
"product": "tauri",
"versions": [
{
"version": ">= 1.0.0, < 1.0.9",
"status": "affected"
},
{
"version": ">= 1.1.0, < 1.1.4",
"status": "affected"
},
{
"version": ">= 1.2.0, < 1.2.5",
"status": "affected"
}
]
}
]
github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9
github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4
github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5
github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp
www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767
www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
26.5%