Description

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-23T10:17:08.677Z",
  "pubdate": "2026-09-23T10:17:08.677Z",
  "executiveSummary": "This vulnerability concerns a security design flaw in the Content Security Policy (CSP) implementation within Tauri applications. The mechanism intended to harden script execution via nonce-based injection is effectively neutralized when the application's script-src directive explicitly permits data: or blob: URI schemes.\nThe vulnerability type is a CSP bypass, which allows an attacker to execute arbitrary JavaScript in the context of the Tauri webview. This significantly undermines the application's security posture, potentially leading to Cross-Site Scripting (XSS).\nAffected systems include Tauri applications that utilize nonce-based CSP hardening while simultaneously allowing data: or blob: sources within the script-src directive. The risk implications are severe, as an attacker with the ability to inject content into the application can bypass nonce protection, leading to unauthorized code execution, sensitive data exfiltration, or complete compromise of the application's client-side logic.\nExploitation requires the attacker to successfully inject a script using the permitted URI schemes. No knowledge of the cryptographically strong nonce is required, as the CSP Level 3 specification treats these URI schemes as authorized sources independently of the nonce attribute.",
  "technicalDetails": "The root cause of this vulnerability lies in the interaction between the CSP Level 3 specification and the configuration of Tauri's script-src directive. While Tauri attempts to provide security hardening by automatically injecting a per-request cryptographically strong nonce into script tags, this protection is bypassed when developers include data: or blob: in their script-src directive.\nAccording to the CSP Level 3 specification, the presence of a nonce in a script-src directive does not override or restrict the execution of scripts loaded via data: or blob: URI schemes if these schemes are explicitly allowed. Consequently, these schemes essentially act as a 'backdoor' that permits script execution without the requirement for a valid nonce.\nThe attack flow begins with an adversary identifying an injection vector, such as an unvalidated input field or a cross-site scripting vulnerability within the application's front-end code. If the application is configured to allow data: or blob: in its script-src, the attacker does not need to guess or intercept the ephemeral nonce.\nInstead, the attacker can craft a payload using a data: URI containing malicious JavaScript, for example: <script src='data:text/javascript,alert(document.domain)'></script>. Because the CSP permits data: URIs, the browser or webview environment will treat the script as trusted, ignoring the absence of a nonce. Similarly, an attacker can create a blob: URL pointing to a malicious script block, which will also execute successfully.\nThe vulnerable component is the CSP configuration policy enforced by the webview container. This flaw is independent of specific Tauri versions, as it is a fundamental behavior of the underlying browser engines complying with the CSP Level 3 standard. The exploit is typically executed from within the application's local origin, making it particularly dangerous in environments where the webview handles untrusted user input or fetches remote resources. Post-exploitation impact includes the ability to interact with the Tauri bridge, access system-level APIs exposed to the frontend, exfiltrate local files, or execute arbitrary command-line operations if the Tauri IPC (Inter-Process Communication) interface is insufficiently restricted.\nAuthentication and privilege requirements depend on the original injection vulnerability; however, once the bypass is achieved, the payload runs with the full permissions of the webview origin."
}