Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

Description

The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default.

Recommendation

Update the @tauri-apps/plugin-shell package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.2.1
• Patched version(s): 2.2.1

References

• GHSA-c9pr-q8gx-3mgp
• CVE-2025-31477
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
• Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - @apollo/sandbox - CVE-2025-59845
• Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions - CVE-2023-38507
• Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events - CVE-2025-64496

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@tauri-apps/plugin-shell