15 matches found
CVE-2026-95623 Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...
CVE-2026-95623 Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...
CVE-2026-95623
CVE-2026-95623 affects the Tauri HTTP plugin (tauri-plugin-http). The plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When a remote server responds with an HTTP 3xx redirect, the underlying reqwest client follows the redirect...
EUVD-2025-28983
Malicious code in bioql PyPI...
CVE-2025-59053
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...
CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...
CVE-2025-59053: Improper Control of Generation of Code
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...
GHSA-C9PR-Q8GX-3MGP Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`
Impact The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was meant to be restricted to a reasonable number of protocols like htt...
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`
Impact The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was meant to be restricted to a reasonable number of protocols like htt...
CVE-2025-31477 Improper Scope Validation in the open Endpoint of tauri-plugin-shell
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...
CVE-2025-31477 Improper Scope Validation in the open Endpoint of tauri-plugin-shell
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...
Malicious code in tauri-plugin-autostart-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b142e694f8cc092c192ccd1c5256735955990e191b4b413415a7304ea45c582c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11180 Malicious code in tauri-plugin-autostart-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b142e694f8cc092c192ccd1c5256735955990e191b4b413415a7304ea45c582c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...