@crabnebula/taurify-api (>=0.1.0, <=0.1.5), @huakunshen/kunkun-ip-info (0.0.7) +13 more potentially affected by CVE-2025-31477 via @tauri-apps/plugin-shell (>=2.0.0-alpha.3, <=2.0.1)

@tauri-apps/plugin-shell NPM version =2.0.0-alpha.3, =0.1.0, =0.0.4-beta.2, =0.0.4-alpha.5, =0.6.0, =0.4.0, =0.1.9, =0.0.2-alpha.0, =0.4.0, =0.0.1, =1.1.0, =2.6.1 Source cves: CVE-2025-31477 Source advisory: GHSA-C9PR-Q8GX-3MGP...

CVE-2025-31477

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...

CVE-2025-31477 Improper Scope Validation in the open Endpoint of tauri-plugin-shell

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...

CVE-2025-31477

CVE-2025-31477 concerns the Tauri shell plugin (prior to 2.2.1). The open endpoint allowed system-opening with protocols like file://, smb://, or nfs:// due to improper validation, enabling remote code execution when untrusted input is passed. Affected: tauri-plugin-shell before version 2.2.1. Mi...

CVE-2025-31477

creationtimestamp| type| source ---|---|--- 2025-04-02 09:40:52+00:00| published-proof-of-concept| https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp 2025-04-02 21:34:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10143 2025-04-02...