Medium severity5.9OSV Advisory· Published May 23, 2024· Updated Apr 15, 2026
CVE-2024-35222
CVE-2024-35222
Description
Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tauricrates.io | < 1.6.7 | 1.6.7 |
tauricrates.io | >= 2.0.0-beta.0, < 2.0.0-beta.20 | 2.0.0-beta.20 |
Affected products
2- Range: 0.5.2-binaries, @tauri-apps/api-v1.4, @tauri-apps/api-v1.4.0, …
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-57fm-592m-34r7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-35222ghsaADVISORY
- github.com/tauri-apps/tauri/commit/d950ac1239817d17324c035e5c4769ee71fc197dghsaWEB
- github.com/tauri-apps/tauri/commit/f6d81dfe0871e0ccd012e5190d41e3767e733608ghsaWEB
- github.com/tauri-apps/tauri/issues/8316nvdWEB
- github.com/tauri-apps/tauri/security/advisories/GHSA-57fm-592m-34r7nvdWEB
News mentions
0No linked articles in our index yet.