CVE-2023-31134

Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

Description

Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websites, but in versions 1.0.0 until 1.0.9, 1.1.0 until 1.1.4, and 1.2.0 until 1.2.5, the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect. This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands. This issue has been patched in versions 1.0.9, 1.1.4, and 1.2.5. As a workaround, prevent arbitrary input in redirect features and/or only allow trusted websites access to the IPC.

Category

4.8
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.21%
Vendor Advisory github.com
Affected: tauri-apps tauri
Published at:
Updated at:

References

Link Tags
https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp vendor advisory
https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9 release notes
https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4 release notes
https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5 release notes
https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767 patch
https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f patch

Frequently Asked Questions

What is the severity of CVE-2023-31134?
CVE-2023-31134 has been scored as a medium severity vulnerability.
How to fix CVE-2023-31134?
To fix CVE-2023-31134, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-31134 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-31134 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-31134?
CVE-2023-31134 affects tauri-apps tauri.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.