Repository navigation
chore(deps): update rust crate tauri to v2.11.1 [security] - #15
renovate[bot] wants to merge 1 commit into
Conversation
5dbd44c to
3fc1d2d
Compare
darkmatteragent
left a comment
darkmatteragent
left a comment
There was a problem hiding this comment.
This PR is a single-file Cargo.lock update (apps/native/src-tauri) moving tauri 2.10.3 → 2.11.1 with the aligned 2.11.x stack (tauri-build/codegen/macros 2.6.3, tauri-runtime 2.11.3, tauri-runtime-wry 2.11.4, tauri-utils 2.9.3, wry 0.55.1, tao 0.35.3, muda 0.19.3, tray-icon 0.23.1), remediating CVE-2026-42184 (GHSA-7gmj-67g7-phm9). I verified the consuming side independently:
-
apps/native/src-tauri/Cargo.toml declares caret requirements
tauri = "2.10.3"andtauri-build = "2.5.6", which admit 2.11.1 / 2.6.3, so the lockfile remains consistent with the manifest andcargo build --lockedresolves the pinned graph. (The manifest version strings are now lower than the resolved versions; that is normal Cargo behavior — the lock is authoritative — though updating them would be tidy.) -
agent-desktop has no direct dependencies beyond tauri/tauri-build; src/lib.rs is the 6-line default Builder. The removals (tauri-plugin-log, tauri-plugin, android_logger, fern, ndk-context, rkyv, rand 0.7/0.8, legacy phf/kuchikiki trees) were all transitive entries of the old tauri stack, not application dependencies, so nothing in the app references them.
-
Lockfile internal consistency holds: crates whose dependency lists lost version suffixes (wasi, phf, cssparser, html5ever, windows-core, etc.) are exactly those now present in a single version; the two-version crates (png 0.17.16/0.18.1, syn 1/2, bitflags 1/2, windows-sys) still carry suffixes on their dependents. New entries (dbus/libdbus-sys, dom_query, ctor-proc-macro/dtor, objc2-* additions) are all reachable from the new tao/tauri-utils/muda/tray-icon.
-
The app does not call register_uri_scheme_protocol and does not load remote content, so the CVE was latent rather than directly exploitable in this template; the bump still closes it for downstream forks that extend the app.
No patch-introduced defects found. The change faithfully serves its stated security-upgrade purpose; merging is appropriate once the native build is confirmed green.
renovate
Bot
changed the title
renovate
Bot
changed the title
3fc1d2d to
05cc97f
Compare
1 participant
This PR contains the following updates:
2.10.3→2.11.1Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands
CVE-2026-42184 / GHSA-7gmj-67g7-phm9
More information
Details
Summary
A flaw in Tauri's
is_local_url()function causes it to incorrectly classify remote URLs as trusted local origins on Windows and Android. On these systems, Tauri maps custom URI scheme protocols tohttp://<scheme>.localhost/because those platforms' WebView implementations cannot serve custom URI schemes directly.The issue is that Tauri's check to see if the origin is local, only checks the first subdomain of the URL. An attacker can abuse this by hosting a page on a domain whose subdomain matches the custom scheme of the application (e.g. http://app.attacker.com/)."
Example:
app://localhost/→ on Android/Windows:http://app.localhost/http://app., includinghttp://app.evil.com/As a result, the attacker page can invoke backend commands that the developer intended to be accessible only to the app's own frontend and that are explicitly restricted from being called by external or remote origins.
Details
Vulnerable function:
Link: https://github.com/tauri-apps/tauri/blob/1ef6a119b1571d1da0acc08bdb7fd5521a4c6d52/crates/tauri/src/webview/mod.rs#L1680
split_once('.')discards everything after the first.. For http://app.evil.com/, the extracted label is app. If the application has registered a protocol named app,protocols.contains_key("app")returnstrueand the URL is classified asOrigin::Local. The correct check must assert the full domain is exactly<protocol>.localhost.PoC
We created a proof of concept app that can be found here. The app registers a custom app:// protocol and exposes a ping command restricted to local origins only. It provides a button to open a URL in a WebView, pre-filled with https://app.robbe-bc9.workers.dev/, an attacker-controlled page that invokes ping on load. Because the domain's first label matches the registered app protocol, is_local_url() classifies it as a local origin and the command succeeds.
capabilities/main.jsoncontains the following code, which only exposespinglocally:{ "$schema": "../../../crates/tauri-schema-generator/schemas/capability.schema.json", "identifier": "main", "local": true, "windows": ["*"], "permissions": [ "sample:allow-ping" ] }src/lib.rscontains the following code, to register a custom scheme:Impact
The attacker page can invoke backend commands that the developer intended to be accessible only to the app's own frontend and that are explicitly restricted from being called by external or remote origins.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
tauri-apps/tauri (tauri)
v2.11.1: @tauri-apps/api v2.11.1Compare Source
PNPM Audit
[2.11.1]
Enhancements
916782601(#15520 by @polw1) Document thatMonitor.size,Monitor.positionandMonitor.workAreaare in physical pixels, with examples showing how to convert them to the logical pixels expected by window creation options viatoLogical(monitor.scaleFactor).PNPM Publish
v2.11.0: @tauri-apps/api v2.11.0Compare Source
PNPM Audit
[2.11.0]
New Features
074299c08(#14307) Add Bring All to Front predefined menu item typea12142a48(#14357) Add macos support for setting the icon and icon template state in the same step of the main thread, to prevent flickering.001c8fe3d(#14722) Add a WebView option to control browser-level general autofill behavior. This option does not disable password or credit card autofill. On Windows (WebView2), setting it to true disables the general autofill "Suggestions" UI, which may appear even whenautocomplete="off"is specified on input elements. On Linux, macOS, iOS, and Android, this option is currently unsupported and performs no operation.eb0312ea9(#15199) Propagates theEvent::SuspendedandEvent::Resumedevents fromtaowhen they are emitted on mobile targets.PNPM Publish
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.