{"id":"CVE-2026-95626","aliases":["EUVD-2026-85177","GHSA-757j-xrg3-9g6p"],"status":"published","title":"Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains","description":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00471,"percentile":0.41239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-23T09:33:09Z","modified":"2026-09-23T19:42:02Z","products":[{"vendor":"tauri","product":"tauri"},{"vendor":"tauri-apps","product":"tauri"}],"references":[{"url":"https://github.com/tauri-apps/tauri/security/advisories/GHSA-6vxm-x265-58qf","tags":["issue-tracking"]},{"url":"https://github.com/tauri-apps/tauri","tags":["product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95626"},{"url":"https://github.com/advisories/GHSA-757j-xrg3-9g6p"}],"sources":{"cve":[{"id":"CVE-2026-95626","title":"Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains","description":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.","status":"published","published":"2026-09-23T09:33:09.366Z","modified":"2026-09-23T14:03:18.426Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:05.505362Z"}],"euvd":[{"id":"EUVD-2026-85177","description":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.","status":"published","published":"2026-09-23T09:33:09Z","modified":"2026-09-23T14:03:18Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:00.949397Z"}],"ghsa":[{"id":"GHSA-757j-xrg3-9g6p","title":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script...","description":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.","status":"published","published":"2026-09-23T12:31:13Z","modified":"2026-09-23T12:31:22Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:19.869437Z"}],"nvd":[{"id":"CVE-2026-95626","description":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.","status":"published","published":"2026-09-23T10:17:08.677Z","modified":"2026-09-23T19:42:02.35Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:50.703874Z"}]}}