CVE-2026-95626 in Tauri
Summary
by MITRE • 09/23/2026
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability described involves a critical misconfiguration in how Content Security Policy (CSP) directives are constructed within Tauri applications, specifically regarding the handling of nonces and unsafe schemes. While Tauri attempts to harden its default CSP by injecting a random nonce into the script-src directive to restrict inline script execution, this protection mechanism is fundamentally bypassed if the policy includes data: or blob: URIs as allowed sources for scripts. This configuration error creates a significant security gap because it allows arbitrary JavaScript code to execute within the application context without requiring knowledge of the injected nonces, effectively nullifying the primary defense against cross-site scripting and other script injection attacks.
From a technical perspective, this flaw stems from how CSP Level 3 specifications interpret source lists containing scheme-based sources like data: or blob:. According to the specification, when these schemes are present in the script-src directive, they permit scripts that originate from those protocols regardless of whether a nonce is provided. Consequently, an attacker who can inject content into the application via a data URI or a Blob URL does not need to guess or steal the dynamic nonce value. The browser will execute any JavaScript embedded within these URIs because the presence of the scheme in the allowlist overrides the requirement for valid nonces associated with other script sources. This behavior is consistent across modern browsers that adhere to CSP Level 3 standards, making it a predictable and exploitable condition rather than an anomaly.
The operational impact of this vulnerability is severe, as it undermines the integrity of the application's security model. Tauri applications often have elevated privileges compared to standard web pages due to their ability to interact with the underlying operating system through IPC mechanisms. If an attacker can inject malicious scripts via data: or blob: URIs, they gain the ability to execute arbitrary code within this privileged context. This could lead to full application compromise, including unauthorized access to sensitive user data, manipulation of local files, or execution of commands on the host machine if further privilege escalation vectors exist. The vulnerability effectively transforms a hardened environment into one that is as vulnerable as an unsecured web page with no CSP protections against script injection via these specific protocols.
This issue aligns with CWE-798, which describes the use of hardcoded credentials or insecure defaults in security configurations, and more specifically relates to improper validation of input data within content security policies. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with Client-side Scripting Injection (T1059) and potentially Command and Control via application layer protocols if the injected scripts are used to communicate back to an attacker-controlled server. The lack of strict enforcement against unsafe schemes represents a failure in implementing robust security controls as outlined in OWASP guidelines for CSP implementation, which emphasize that nonces should be combined with other restrictions rather than being diluted by permissive scheme allowances.
To mitigate this vulnerability, developers must strictly audit and modify their Content Security Policy configurations within Tauri applications. The most effective remediation is to remove data: and blob: from the script-src directive entirely if they are not absolutely necessary for legitimate application functionality. If these schemes are required for specific features such as loading dynamic content or images that might contain executable scripts, developers should implement additional controls such as strict nonce enforcement by ensuring no other sources bypass the nonce requirement. Alternatively, using a hash-based approach combined with nonces can provide layered security, although removing unsafe schemes remains the most robust defense against script injection attacks in privileged environments like Tauri applications. Regular security audits and static analysis tools configured to detect insecure CSP configurations should be integrated into the development pipeline to prevent such misconfigurations from reaching production.