PT-2026-38262 · Crates.Io+2 · Tauri

Grumpinout1 · Published 2026-05-06 · Updated 2026-05-27 · CVE-2026-42184

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tauri versions 2.0 through 2.10.2

Description A flaw in the is local url() function causes remote URLs to be incorrectly classified as trusted local origins on Windows and Android. On these platforms, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because the WebView implementations cannot serve custom URI schemes directly. The issue arises because the check for local origins only validates the first subdomain of the URL. An attacker can exploit this by hosting a page on a domain where the first subdomain matches the application's custom scheme (e.g., http://app.attacker.com/). This allows an attacker-controlled page to invoke backend commands that were intended to be restricted to the application's own frontend and protected from external or remote origins.

Recommendations Update to version 2.10.3.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42184

GHSA-7GMJ-67G7-PHM9

Affected Products

Tauri

References · 4

• 🔥 https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9 · Exploit
• https://osv.dev/vulnerability/GHSA-7gmj-67g7-phm9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42184 · Security Note
• https://github.com/tauri-apps/tauri · Note