tauri-apps tauri up to 2.11.0 on Windows is_local_url server-side request forgery

Summaryinfo

A vulnerability identified as critical has been detected in tauri-apps tauri up to 2.11.0 on Windows. This issue affects the function is_local_url. This manipulation causes server-side request forgery. This vulnerability appears as CVE-2026-42184. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in tauri-apps tauri up to 2.11.0 on Windows and classified as critical. Affected by this vulnerability is the function is_local_url. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols to http://.localhost/ because those platforms' WebView implementations cannot serve custom URI schemes directly. The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application. This vulnerability is fixed in 2.10.3.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-42184 since 04/25/2026. The exploitation appears to be difficult. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.11.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• tauri-apps

Name

• tauri

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11.0

Website

• Product: https://github.com/tauri-apps/tauri/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion