CyberRota Analysis
AI-GeneratedThe vulnerability affects Tauri applications utilizing the dialog plugin's file or folder picker, allowing an attacker with JavaScript execution capabilities to exploit the file dialog. This can lead to recursive scope expansion, granting unauthorized read/write access to an entire directory tree without the user's knowledge, and the permissions cannot be revoked during the application's runtime. Developers of Tauri applications should prioritize addressing this issue to mitigate potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.