CVE-2024-35222

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.

• CWE-284

• https://github.com/tauri-apps/tauri/issues/8316
• https://github.com/tauri-apps/tauri/security/advisories/GHSA-57fm-592m-34r7
• https://github.com/tauri-apps/tauri/issues/8316
• https://github.com/tauri-apps/tauri/security/advisories/GHSA-57fm-592m-34r7

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35215NULL pointer dereference in IP socket options processing of …6.2
• CVE-2024-35218Umbraco CMS is an ASP.NET CMS used by more than 730.000 webs…4.8
• CVE-2024-35219OpenAPI Generator allows generation of API client libraries …8.3
• CVE-2024-3522A vulnerability classified as critical has been found in Cam…8.8
• CVE-2024-35220@fastify/session is a session plugin for fastify. Requires t…7.4
• CVE-2024-35221Rubygems.org is the Ruby community's gem hosting service. A …4.3
• CVE-2024-35223Dapr is a portable, event-driven, runtime for building distr…5.3
• CVE-2024-35224OpenProject is the leading open source project management so…5.4
• CVE-2024-35225Jupyter Server Proxy allows users to run arbitrary external …6.1
• CVE-2024-35226Smarty is a template engine for PHP, facilitating the separa…7.3
• CVE-2024-35227Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2024-35228Wagtail is an open source content management system built on…5.5