CVE-2026-95626

Published: Sep 23, 2026Modified: Sep 23, 2026Deferred

8.3

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 6.0

Source: reefs@jfrog.com (Secondary)

Description

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/tauri-apps/tauri

Source: reefs@jfrog.com

https://github.com/tauri-apps/tauri/security/advisories/GHSA-6vxm-x265-58qf

Source: reefs@jfrog.com

Timeline

No history available yet.