CVE-2026-95626: Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove data: and blob: from the script-src directive so CSP nonce protection can restrict script execution.
Tauri framework v2 Content-Security-Policy script-src = Exclude data: and blob: scheme sources
Event History
Frequently Asked Questions
Which applications are exposed to this bypass?
Tauri framework v2 applications whose script-src Content Security Policy includes either data: or blob: are exposed. In that configuration, the injected random nonce does not restrict scripts loaded through those URI schemes.
What does an attacker need to exploit the issue?
An attacker needs a way to trigger an XSS condition in the application and user interaction, as indicated by the UI:R vector. The attacker does not need to know the CSP nonce when data: or blob: is allowed in script-src.
Are default configurations affected?
The available information identifies exposure only when data: or blob: is included in the script-src directive. It does not state whether either scheme is present in the default Tauri v2 configuration.
What mitigation is available if patching cannot happen immediately?
Remove data: and blob: from the script-src Content Security Policy directive where possible. This prevents those scheme sources from remaining executable despite the nonce.