CVE-2026-42184: fallo de gravedad media en tauri-apps tauri
Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
tauri-apps · tauriCVEs relacionadas — tauri-apps tauri
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-46171MEDIUMTauri vulnerable to path traversalEPSS 1.1%CVE-2022-39215HIGHThe readDir Endpoint Scope can be Bypassed With Symbolic Links in TauriEPSS 1.0%CVE-2023-34460MEDIUMTauri vulnerable to Regression on Filesystem Scope Checks for DotfilesEPSS 0.6%CVE-2023-31134MEDIUMTauri Open Redirect Vulnerability Possibly Exposes IPC to External SitesEPSS 0.5%CVE-2022-41874LOWTauri Filesystem Scope can be Partially BypassedEPSS 0.5%CVE-2024-35222MEDIUMiFrames Bypass Origin Checks for Tauri API Access ControlEPSS 0.3%