EUVD-2026-85177
GHSA-757j-xrg3-9g6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Tauri app with data:/blob: in script-src
-
DeliveryFind HTML/script injection sink
-
ExploitDeliver script via data:/blob: URL
-
ExecutionBypass CSP nonce, execute arbitrary JS
-
PersistInvoke Tauri IPC/backend commands
-
ImpactCompromise host beyond webview
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is possible ONLY when the Tauri application's own Content Security Policy script-src directive explicitly includes the 'data:' or 'blob:' scheme source - a non-default developer configuration choice that renders Tauri's automatic nonce injection ineffective per the CSP Level 3 specification. In addition, the attacker needs a script/markup injection vector within the app's webview content, and per the CVSS vector user interaction (UI:R) is required. Apps that keep the default hardened CSP (no data:/blob: in script-src) are NOT exploitable; the nonce protection functions as intended. This is a client-side/webview condition - there is no unauthenticated network service to reach directly. |
| Impact | CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) rates this High, but real-world risk is heavily gated by a non-default developer misconfiguration rather than an attacker-controllable condition. The flaw is a defense-in-depth failure: Tauri's CSP nonce hardening is silently neutralized only when the application itself adds 'data:' or 'blob:' to its script-src directive - which per CSP Level 3 keeps those scheme-sources active regardless of the nonce. AC:H and UI:R correctly capture that exploitation requires both this misconfiguration AND an actual script-injection vector plus user interaction. PR:N is accurate (attacker needs no privileges), and S:C/C:H/I:H/A:H reflect that script execution inside a Tauri webview can reach the Rust backend/IPC and thus the host OS. No EPSS score, no CISA KEV entry, and no POC were provided in the input, so there is no signal of active or automated exploitation - this reads as a hardening-bypass advisory to remediate on a normal patch cycle, not an emergency. It is a legitimate issue but NOT a drop-everything priority: the high CVSS is diluted by the requirement that the affected app already weakened its own CSP. |
| Exploit ScenarioDerived | A developer ships a Tauri app whose CSP script-src includes 'data:' or 'blob:' (e.g., to support inline/generated scripts). An attacker who can inject markup through a stored/reflected XSS sink then delivers a script via a data:/blob: URL that executes without the nonce, and - because Tauri webview scripts can invoke backend IPC commands - pivots from webview code execution toward the host. No public exploit code is identified at time of analysis; disclosure is via the JFrog-reported GHSA-6vxm-x265-58qf advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Tauri's automatic CSP nonce injection - a hardening feature meant to restrict script execution inside the app webview - is rendered completely ineffective when the application's own script-src directive lists the data: or blob: scheme sources, because CSP Level 3 keeps scheme sources active regardless of a nonce being present. An attacker who can place markup or script into webview content in such an application can therefore execute arbitrary script without ever knowing the nonce, enabling script execution, data theft, or privilege abuse through the embedded webview; Tauri applications that retain the default hardened CSP without data: or blob: in script-src are not affected. The issue is rated CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) but is gated by a non-default developer configuration choice plus a separate injection vector within the app, and no public exploit was identified at time of analysis.
RemediationAI
The most direct and least invasive fix is a configuration change in each affected Tauri application: remove the data: and blob: scheme sources from the CSP script-src directive so that only nonce-based (or nonce plus strict-dynamic) script sources are permitted, which restores the effectiveness of Tauri's automatic nonce injection; the trade-off is that any application feature that loads scripts from data URIs or blob URLs will break and must be refactored to load scripts from bundled or fetched assets that can carry a nonce or integrity hash. Where blob-based script loading cannot be removed immediately, restrict the rest of the CSP aggressively and eliminate the markup/script injection vectors that would let an attacker place content into the webview, since exploitation still requires an injection path plus user interaction (UI:R). Note that nonce-only CSPs are the intended hardened posture; adding 'strict-dynamic' alongside the nonce can further limit host allowlists without reintroducing scheme sources. No vendor-released patched version is identified in the provided intelligence, so teams should consult the vendor advisory GHSA-6vxm-x265-58qf for the current fix status and upgrade Tauri once a fixed release is published; until then, treat the CSP configuration change and injection-vector elimination as the primary compensating controls, and review application CSP definitions in code and build configuration to catch cases where data: or blob: was added for a specific feature.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tauri is a Rust-based framework for building desktop and mobile applications whose UI runs in an embedded webview (WRY over WebKit on macOS/Linux, WebView2 on Windows). To mitigate cross-site scripting in that webview, Tauri injects a per-load random nonce into the Content Security Policy and tags its own scripts with that nonce. Per the CSP Level 3 specification, nonce-based source expressions do not suppress scheme sources such as data: and blob: - those schemes remain permitted, so an injected inline or blob-hosted script still runs even though the nonce is unknown to the attacker. The root cause class is CWE-79 (improper neutralization of input during web page generation / cross-site scripting), because the hardening control silently fails to constrain script execution once the developer's script-src allowlist includes those schemes. The CPE string cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* indicates the framework is version-agnostic in this advisory, meaning the flaw is a property of the CSP-generation logic rather than a single release. Successfully exploiting it requires the application to define a CSP containing data: or blob: in script-src and to expose some script or markup injection path into the webview content.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because it requires the app to misconfigure script-src with data:/blob: plus an injection vector; PR:N/UI:R as attacker needs no auth but user interaction; S:C and full triad reflect webview script reaching Tauri backend/host.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
DescriptionCVE.org
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.
Technical POC Analysis
CWE-79 (assigned by the advisory), though the mechanism is a CSP policy-strength failure that yields script injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Tauri applications that list data: or blob: in their script-src CSP directive are vulnerable to a hardening bypass enabling arbitrary script execution within the embedded webview. This can lead to data theft or privilege abuse, affecting users and organizational data, though exploitation requires a non-default configuration and a separate injection vector; no public exploit was identified at time of analysis. Leadership should care because a successful attack could compromise application integrity and confidentiality across affected deployments.
Remove data: and blob: from the script-src directive in the Tauri application's CSP configuration; sanitize all user-supplied markup and script inputs before rendering in the webview; and restrict webview content to trusted sources where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB