Tauri Plugin Http
Monthly
Server-side request forgery in the Tauri HTTP plugin (tauri-plugin-http) before http-v2.7.0 lets any host the plugin's scope allowlist permits - a host the attacker controls or one hosting an open redirect - bounce the request onward to destinations the scope explicitly denies, including cloud metadata endpoints such as 169.254.169.254, localhost services, and internal network hosts. The plugin's reqwest client follows HTTP 3xx redirects internally and the scope allowlist was only evaluated against the frontend's original URL, so the redirect target is never re-checked; the response is then returned to the webview. Rated CVSS 5.6 (assessed AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N), it is unauthenticated but requires an attacker-influenced allowlisted origin and a frontend that actually issues the fetch; there is confirmed actively exploited (CISA KEV) status, no public exploit identified at time of analysis, and the vendor fix is opt-in.
Server-side request forgery in the Tauri HTTP plugin (tauri-plugin-http) before http-v2.7.0 lets any host the plugin's scope allowlist permits - a host the attacker controls or one hosting an open redirect - bounce the request onward to destinations the scope explicitly denies, including cloud metadata endpoints such as 169.254.169.254, localhost services, and internal network hosts. The plugin's reqwest client follows HTTP 3xx redirects internally and the scope allowlist was only evaluated against the frontend's original URL, so the redirect target is never re-checked; the response is then returned to the webview. Rated CVSS 5.6 (assessed AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N), it is unauthenticated but requires an attacker-influenced allowlisted origin and a frontend that actually issues the fetch; there is confirmed actively exploited (CISA KEV) status, no public exploit identified at time of analysis, and the vendor fix is opt-in.