CVE-2026-95627

Name of the Vulnerable Software and Affected Versions Tauri (affected versions not specified)

Description An attacker with JavaScript execution capabilities, such as through Cross-Site Scripting (XSS), can manipulate the dialog plugin's file or folder picker. This allows the attacker to force a recursive scope expansion, granting unauthorized read and write access to an entire directory tree following a single user interaction with a standard operating system file dialog. The user is not notified that recursive access has been granted, and this expanded scope remains active and irrevocable for the duration of the application session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.