CVE-2023-34460— Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Quick assessment
Affected
tauri-apps tauri
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri 1.4.0版本存在授权问题漏洞，该漏洞源于包含对 Unix 上点文件的文件系统范围检查的回归。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-34460
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Source: CVE Program / CVE List V5
Vulnerability Description
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Tauri 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri 1.4.0版本存在授权问题漏洞，该漏洞源于包含对 Unix 上点文件的文件系统范围检查的回归。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tauri-apps | tauri | = 1.4.0 | - |
|
II. Public POCs for CVE-2023-34460
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-34460
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-34460 (3)
-
https://github.com/tauri-apps/tauri/pull/7227 x_refsource_MISC
-
https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347 x_refsource_MISC
Vendor Advisories for CVE-2023-34460 (1)
-
https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: tauri
-
CVE-2026-95626
Tauri framework v2 CSP nonce protection bypass via data and -
CVE-2026-42184
Tauri: Origin Confusion Allows Remote Pages to Invoke Local- -
CVE-2024-35222
iFrames Bypass Origin Checks for Tauri API Access Control -
CVE-2023-46115
Updater Private Keys Possibly Leaked via Vite Environment Va -
CVE-2023-31134
Tauri Open Redirect Vulnerability Possibly Exposes IPC to Ex
Same vendor: tauri-apps
-
CVE-2026-42184
Tauri: Origin Confusion Allows Remote Pages to Invoke Local- -
CVE-2025-31477
Improper Scope Validation in the open Endpoint of tauri-plu -
CVE-2024-35222
iFrames Bypass Origin Checks for Tauri API Access Control -
CVE-2023-46115
Updater Private Keys Possibly Leaked via Vite Environment Va -
CVE-2023-31134
Tauri Open Redirect Vulnerability Possibly Exposes IPC to Ex
Same weakness: CWE-285
-
CVE-2026-11930
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-16181
IBM DataPower Gateway Improper Authorization -
CVE-2026-76275
Improper Authorization in Search Job Listings through the RE -
CVE-2026-105621
jishenghua jshERP Financial Receipt Update AccountHeadServic -
CVE-2026-105611
chillzhuang SpringBlade User Detail Endpoint RoleController.
V. Comments for CVE-2023-34460
No comments yet