CVE-2026-95626
Received Received - Intake

Tauri CSP Bypass via data: or blob: in script-src

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: JFrog

Description
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95626
EUVD
EUVD-2026-85177

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tauri_apps tauri *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Tauri applications using Content Security Policy (CSP) hardening. When an app includes data: or blob: in its script-src directive, the injected nonce for CSP does not restrict script execution. These scheme sources bypass the nonce requirement, allowing arbitrary script execution without needing the nonce value.

Detection Guidance

To detect this vulnerability, inspect your Tauri application's CSP configuration for script-src directives containing data: or blob: schemes. Check if these schemes are present alongside a nonce, which would indicate misconfiguration. Review application source code and CSP headers for these patterns.

Impact Analysis

An attacker could exploit this to execute malicious scripts in your Tauri application, potentially stealing data, hijacking sessions, or performing unauthorized actions. The impact includes high confidentiality, integrity, and availability risks due to the CVSS score of 8.3.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Remove data: and blob: from the script-src directive in your CSP configuration. Replace them with specific, trusted domains or remove them entirely if not required. Ensure all scripts are loaded via nonce or hash-based validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95626. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart