Vulnerability LowRUSTSEC-2022-0091 · tauri
RUSTSEC-2022-0091: `tauri` filesystem scope partial bypass
Short answerA security vulnerability in the tauri crate: `tauri` filesystem scope partial bypass. Low severity (CVSS 2.3). Fixed in 1.0.7, 1.1.2: update to a fixed version.
| Crate | tauri |
|---|---|
| Type | Vulnerability (privilege-escalation) |
| Affected versions | From 1.0.0 before 1.0.7; from 1.1.0 before 1.1.2. |
| Fixed in | 1.0.7, 1.1.2 |
| Severity | Low, CVSS 2.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N |
| Published | 2022-09-19 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2022-41874, GHSA-q9wv-22m9-vhqh |
What to do
- See which version you have:
cargo tree -i tauri(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p tauri. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampletauri = "1.1.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
A bug identified in this issue allows a partial filesystem scope bypass if glob characters are used within file dialog or drag-and-drop functionalities.
This PR fixes the issue by escaping glob characters.
References
- Package: crates.io/crates/tauri
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0091.html
- Report: github.com/tauri-apps/tauri/issues/5234
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for tauri
- Vulnerability MediumRUSTSEC-2022-0088 · 2022-08-07`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope
- VulnerabilityGHSA-4wm2-cwcf-wwvp · 2023-05-03Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
- VulnerabilityGHSA-4wm2-cwcf-wwvp · 2023-05-03Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
- VulnerabilityGHSA-4wm2-cwcf-wwvp · 2023-05-03Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
- VulnerabilityGHSA-57fm-592m-34r7 · 2024-05-23iFrames Bypass Origin Checks for Tauri API Access Control
- VulnerabilityGHSA-57fm-592m-34r7 · 2024-05-23iFrames Bypass Origin Checks for Tauri API Access Control
- VulnerabilityGHSA-6mv3-wm7j-h4w5 · 2022-12-22Tauri Filesystem Scope Glob Pattern is too Permissive
- VulnerabilityGHSA-6mv3-wm7j-h4w5 · 2022-12-22Tauri Filesystem Scope Glob Pattern is too Permissive
Up next
Same cratetauri: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?