Description
The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default.
Recommendation
Update the @tauri-apps/plugin-shell package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.2.1
- Patched version(s): 2.2.1
References
Could your website be exposed too?
SmartScanner can check your website for Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
- Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - @apollo/sandbox - CVE-2025-59845
- Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions - CVE-2023-38507
- Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events - CVE-2025-64496
You might also like:
See something that needs correcting? Let us knowUpdated April 03, 2025