CVE-2026-42184 Details
Description
Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://<scheme>.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.
A vulnerability exists in Tauri versions 2.0 through 2.11.0, where the 'is_local_url()' function incorrectly identifies remote URLs as trusted local origins on Windows and Android. This misclassification allows remote pages to invoke local-only inter-process communication (IPC) commands. The issue arises because Tauri's origin check only evaluates the first subdomain, enabling attackers to exploit custom URI schemes by hosting pages on matching subdomains. The vulnerability is patched in Tauri version 2.11.1.
Users can update to Tauri version 2.11.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/tauri-apps/tauri/security/advisories/GHSA-7gmj-67g7-phm9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tauri tauri | >= 2.0.0, < 2.10.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |