https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:43:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-5615 EUVD-2026-5615 https://cve.radiocsirt.org/vuln/euvd-2026-5615 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35222 <p>Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences (&#34;delete project&#34;, &#34;transfer credits&#34;, etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.</p> <p>Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences (&#34;delete project&#34;, &#34;transfer credits&#34;, etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-35222 https://cve.radiocsirt.org/vuln/ghsa-57fm-592m-34r7 <p><strong>Affected:</strong> crates.io: tauri</p> <p>## Impact</p> <p>Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the [`dangerousRemoteDomainIpcAccess`](https://v1.tauri.app/api/config/#securityconfig.dangerousremotedomainipcaccess) in v1 and in the [`capabilities`](https://v2.tauri.app/security/capabilities/#remote-api-access) in v2. This bypasses the origin check and allows iFrames to access the IPC endpoints exposed to the parent window.</p> <p>For this to be exploitable, an attacker must have script execution (e.g. XSS) in a script-enabled iFrame of a Tauri application.</p> <p>## Patches</p> <p>The patches include changes to wry and the behaviour of Tauri applications using iFrames. Previously, we injected the Tauri IPC initialization script into iFrames on MacOS, which was unintended. This is now also disabled to be consistent with all other supported operating systems.</p> <p>This means that the Tauri invoke functionality is no longer accessible from iFrames, except on Windows when the origin of the Tauri window and the origin of the iFrame are the same.</p> <p>We have also added a new protection mechanism to the IPC layer to protect against iFrames directly using the WebView IPC functionality (e.g. via `window.ipc.postMessage`). This introduces an invoke key (`__TAURI_INVOKE_KEY__`) which is used to prevent frames that have not been initialized by the Tauri core from sending messages to the Tauri IPC. This key is **not** used to protect against compromised Tauri windows or WebViews and…</p> <p><strong>Affected:</strong> crates.io: tauri</p> <p>## Impact</p> <p>Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the [`dangerousRemoteDomainIpcAccess`](https://v1.tauri.app/api/config/#securityconfig.dangerousremotedomainipcaccess) in v1 and in the [`capabilities`](https://v2.tauri.app/security/capabilities/#remote-api-access) in v2. This bypasses the origin check and allows iFrames to access the IPC endpoints exposed to the parent window.</p> <p>For this to be exploitable, an attacker must have script execution (e.g. XSS) in a script-enabled iFrame of a Tauri application.</p> <p>## Patches</p> <p>The patches include changes to wry and the behaviour of Tauri applications using iFrames. Previously, we injected the Tauri IPC initialization script into iFrames on MacOS, which was unintended. This is now also disabled to be consistent with all other supported operating systems.</p> <p>This means that the Tauri invoke functionality is no longer accessible from iFrames, except on Windows when the origin of the Tauri window and the origin of the iFrame are the same.</p> <p>We have also added a new protection mechanism to the IPC layer to protect against iFrames directly using the WebView IPC functionality (e.g. via `window.ipc.postMessage`). This introduces an invoke key (`__TAURI_INVOKE_KEY__`) which is used to prevent frames that have not been initialized by the Tauri core from sending messages to the Tauri IPC. This key is **not** used to protect against compromised Tauri windows or WebViews and…</p> https://cve.radiocsirt.org/vuln/ghsa-57fm-592m-34r7