CVE-2023-34460
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The 1.4.0 release of the Tauri framework introduced a regression in the filesystem scope check for dotfiles on Unix. Previously, dotfiles were not implicitly allowed by wildcard patterns, which changed due to the implementation of a configuration option.
Risk Assessment
Organizations using Tauri applications that employ wildcard patterns in the `fs` endpoint may be exposed to unauthorized access to dotfiles. This could lead to the disclosure of sensitive information.
Recommendation
It is recommended to upgrade to version 1.4.1 to address this regression and restore proper security measures. Additionally, review the configurations of applications using Tauri for the use of wildcard patterns.
Original NVD description (English source)
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.