CVE-2024-35222— iFrames Bypass Origin Checks for Tauri API Access Control
Quick assessment
Affected
tauri-apps tauri
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri存在安全漏洞，该漏洞源于允许攻击者通过应用程序中的远程源iFrame访问Tauri IPC端点并执行delete project等命令。受影响的产品和版本：Tauri 1.6.6及之前版本，2.0.0-beta.0至2.0.0-beta.19版本。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-35222
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
iFrames Bypass Origin Checks for Tauri API Access Control
Source: CVE Program / CVE List V5
Vulnerability Description
Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Tauri 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri存在安全漏洞，该漏洞源于允许攻击者通过应用程序中的远程源iFrame访问Tauri IPC端点并执行delete project等命令。受影响的产品和版本：Tauri 1.6.6及之前版本，2.0.0-beta.0至2.0.0-beta.19版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tauri-apps | tauri | <= 1.6.6 | - |
|
II. Public POCs for CVE-2024-35222
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-35222
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-35222 (1)
-
https://github.com/tauri-apps/tauri/security/advisories/GHSA-57fm-592m-34r7 x_refsource_CONFIRM
Other References for CVE-2024-35222 (1)
-
https://github.com/tauri-apps/tauri/issues/8316 x_refsource_MISC
IV. Related Vulnerabilities
Same product: tauri
-
CVE-2026-95626
Tauri framework v2 CSP nonce protection bypass via data and -
CVE-2026-42184
Tauri: Origin Confusion Allows Remote Pages to Invoke Local- -
CVE-2023-46115
Updater Private Keys Possibly Leaked via Vite Environment Va -
CVE-2023-34460
Tauri vulnerable to Regression on Filesystem Scope Checks fo -
CVE-2023-31134
Tauri Open Redirect Vulnerability Possibly Exposes IPC to Ex
Same vendor: tauri-apps
-
CVE-2026-42184
Tauri: Origin Confusion Allows Remote Pages to Invoke Local- -
CVE-2025-31477
Improper Scope Validation in the open Endpoint of tauri-plu -
CVE-2023-46115
Updater Private Keys Possibly Leaked via Vite Environment Va -
CVE-2023-34460
Tauri vulnerable to Regression on Filesystem Scope Checks fo -
CVE-2023-31134
Tauri Open Redirect Vulnerability Possibly Exposes IPC to Ex
Same weakness: CWE-284
-
CVE-2026-105823
ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder -
CVE-2026-76281
Improper Access Control in Splunk Enterprise -
CVE-2026-76265
Improper Access Control through REST API Endpoints in Splunk -
CVE-2026-76463
Cisco Meraki Security Hardening Release: October 2026 - Impr -
CVE-2026-76498
Cisco Application Policy Infrastructure Controller Hardening
V. Comments for CVE-2024-35222
No comments yet