Content Security Policy Vulnerability in Tauri by Tauri Apps

CVE-2026-95626

What is CVE-2026-95626?

Tauri's implementation of the Content Security Policy (CSP) aims to enhance security by injecting a unique nonce for script execution control. However, it fails to provide adequate protection when applications utilize 'data:' or 'blob:' sources within their script-src directive. According to CSP Level 3 specifications, these sources maintain their execution capabilities irrespective of the presence of a nonce, thereby allowing arbitrary scripts to run without knowledge of the nonce value. This oversight opens avenues for potential exploitation, where malicious scripts could be executed in the context of a vulnerable application.

References