Remote Code Execution Exposure in Tauri Shell Plugin by Tauri

CVE-2025-31477

What is CVE-2025-31477?

The Tauri shell plugin, designed to facilitate system shell operations, contains a vulnerability that permits unregulated access to executable commands and programs on a user's system. Prior to version 2.2.1, the plugin lacked proper validation for allowed protocols, opening the door for potentially harmful protocols such as file://, smb://, and nfs://. This oversight could be exploited by malicious actors who provide untrusted inputs to the plugin's open endpoint, leading to potential remote code execution either directly or through vulnerable frontend applications using Tauri. The issue has since been rectified in the latest release.

References