CVE-2026-95626

Executive Summary

CVE-2026-95626 is a Content Security Policy (CSP) bypass affecting applications built with the Tauri framework that rely on Tauri's automatic CSP hardening mechanism (random nonce injection) to restrict script execution. When an application's script-src directive includes the data: or blob: scheme sources, Tauri's nonce-based hardening provides zero protection, because per the CSP Level 3 specification these scheme sources remain active regardless of whether a valid nonce is present. This allows an attacker who can inject script content or markup into a rendered context to execute arbitrary JavaScript without knowing the nonce, defeating the intended XSS mitigation. The vulnerability carries a CVSS base score of 8.3 (High) and is currently unpatched, with no public proof-of-concept, no Nuclei template, and no CISA KEV listing.

Technical Analysis

Tauri is a framework for building cross-platform desktop (and increasingly mobile) applications using web technologies for the frontend, with a native backend written in Rust. A core security feature of Tauri is its CSP handling: the framework generates a hardened Content Security Policy for the application's webview, injecting a per-load random nonce into script directives (script-src) so that only scripts bearing that correct nonce are permitted to execute. The operational intent is to neutralize most XSS-class injection attacks — even if an attacker manages to inject markup that attempts to load a script, the injected script lacks the secret nonce and should be blocked by the browser's CSP enforcement.

CVE-2026-95626 documents a fundamental implementation gap in this hardening. Per the W3C Content Security Policy Level 3 specification, when a nonce-source is present in script-src, scheme-based sources like data: and blob: are not subject to nonce enforcement in the way developers commonly assume. Scheme sources (e.g., data: and blob:) remain valid and active "even when a nonce is present." The consequence is that if a Tauri application's CSP is configured with script-src including data: or blob:, the nonce injection provides no actual protection against script execution via those schemes. An attacker can construct a script (or embed script content) using a data: URI or a blob: URI and have it execute successfully without possessing or guessing the nonce.

The vulnerability class is a CSP misconfiguration enabling Cross-Site Scripting (CWE-79). It is not a memory-safety bug, a remote code execution flaw in the Rust backend, or an authentication bypass. The security control under attack is the script-execution restriction enforced by the webview; the weakness is that Tauri's hardening does not (and, per spec semantics, cannot) override explicit scheme-source allowances authored into the policy.

Several derived characteristics follow from the NVD description:

• Reachability requires injection capability. The flaw is only exploitable in combination with a mechanism that allows an attacker to cause a data: or blob: script source to be loaded in the application's webview context. Tauri's hardening was designed as a defense-in-depth control against exactly that class of injection. CVE-2026-95626 describes a scenario where that defense-in-depth layer is inert.
• No nonce knowledge is required. The bypass does not involve brute-forcing, leaking, or predicting the random nonce. The scheme source is honored independently of nonce matching, so the attacker's script payload simply sidesteps the nonce constraint.
• Configuration-dependent. Whether a given application is affected depends on whether its effective CSP script-src directive lists data: and/or blob: — for example, because the application author added them to support a feature, or because they were present in a default/template configuration. The NVD entry does not enumerate affected versions, so the affected version range and precise configuration trigger must be determined per deployment.

Because the report data contains no vendor patch, no advisory URL, no affected-version list, and no OSV package mapping, the precise release line and commit boundaries cannot be stated and are not asserted here. Analysts should treat any Tauri application whose CSP includes data: or blob: in script-src as potentially affected until configuration review proves otherwise.

Exploitation Scenarios

The following attack chain is derived strictly from the vulnerability class and the mechanisms named in the NVD description. No public PoC or exploit code exists as of this writing; the chain below is an inference from the CSP bypass class and Tauri's stated hardening behavior. No specific Tauri API names, file paths, or function names are asserted because the source description provides none.

1. Reconnaissance / target identification. The attacker identifies a target application built with Tauri whose webview CSP includes data: or blob: in the script-src directive. This can be determined by inspecting the application's loaded policy (the effective CSP is generally observable in the rendered context / response headers of the webview) or by publishing/planting injection vectors into content the app renders. Because the flaw is configuration-dependent, the attacker first confirms the script-src scheme-source allowance exists.

2. Triggering the flaw class (injection). The attacker needs an injection primitive that causes malicious content to be rendered inside the application's webview — the classic XSS entry condition. Such a primitive could arise through untrusted data rendered by the frontend. The CSP nonce hardening is precisely the control that is supposed to stop resulting script execution; here it does not, because the attacker's execution vector is a scheme source rather than a nonce-bearing tag.

3. Payload / execution at the vulnerability-class level. Per the NVD description, the attacker uses a data: or blob: source within script-src to execute arbitrary JavaScript. The attacker does not need the nonce. The script content is delivered/loaded through the scheme source that the CSP still permits, and the browser executes it despite the nonce-based hardening being in place. The exact delivery mechanics (e.g., how the data:/blob: URL is surfaced into the DOM) are not specified in the provided data and are therefore not asserted.

4. Post-exploitation impact. Once arbitrary JavaScript executes in the Tauri webview context, the attacker inherits the trust and privileges of the application's frontend. This exposes user data and application state, and — depending on the application's permitted IPC surface — can enable interaction with native backend functionality that the frontend is authorized to invoke. The CVSS scope change (S:C) reflects that the executed script impacts resources beyond the initially vulnerable webview component. Full confidentiality and integrity impact (C:H/I:H) and full availability impact (A:H) are scored.

Note: Because no PoC, exploit code, or Nuclei template is available, the exploitation mechanics above remain at the vulnerability-class level. No public exploitation in the wild has been reported.

Impact Assessment

CVE-2026-95626 has a CVSS 3.1 base score of 8.3 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Subscore interpretation:

• Attack Vector: Network (AV:N). The attack is deliverable over a network path (e.g., content fetched/rendered by the app), not confined to physical or adjacent access.
• Attack Complexity: High (AC:H). Successful exploitation requires specific preconditions: the application's CSP must include data: or blob: in script-src, and the attacker must additionally possess an injection primitive capable of surfacing a scheme-sourced script into the webview. These conditions raise complexity.
• Privileges Required: None (PR:N). No authenticated or elevated privileges are needed by the attacker.
• User Interaction: Required (UI:R). Exploitation depends on a user interacting with the application/content in a manner that triggers rendering of the crafted payload.
• Scope: Changed (S:C). The impact crosses a security boundary — the executed script affects components beyond the vulnerable webview's authorization scope (consistent with the Tauri frontend→backend trust relationship).
• Confidentiality/Integrity/Availability: High/High/High. A successful bypass allows arbitrary script execution, which can exfiltrate secrets and user data (C:H), manipulate application state and potentially invoke privileged frontend-exposed operations (I:H), and disrupt application behavior (A:H).

Business impact. Tauri is widely used to build desktop applications that frequently handle sensitive local data, credentials, and privileged native operations. A CSP bypass that permits arbitrary script execution undermines a principal security control developers rely on as defense-in-depth. Where such applications process regulated, personal, or proprietary data, a successful bypass could enable data exfiltration and unauthorized actions through the application's own interfaces. The "High" complexity and required user interaction temper mass-exploitation risk, but the scope-changed, high-impact subscores mean individual compromise is severe. Because the issue is unpatched and configuration-dependent, the effective blast radius across the ecosystem is presently indeterminate; no affected-version list or package mapping is available to bound it. There is no CISA KEV listing as of this report.

Detection Guidance

Detection for this vulnerability is challenging because the bypass exploits a legitimate browser feature (scheme sources) rather than a signature-defined payload. Detection therefore focuses on two vectors: (1) auditing application CSP configuration for dangerous script-src scheme sources, and (2) detecting data:/blob: script execution or injection attempts at runtime, host, and network layers. The rules below are illustrative detection scaffolding aligned to the vulnerability class and should be tuned to the environment. No exploit artifacts are known.

Sigma Rule

title: Tauri CSP Bypass - Suspicious data or blob Script Source Loading
id: 8f3c1a92-5d44-4e21-9a7b-6c0e2f9b1d33
status: experimental
description: Detects process or file activity consistent with data:/blob: scheme based script execution potentially abusing a weakened Tauri Content Security Policy (CVE-2026-95626).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95626
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_tauri:
    Image|endswith:
      - '\app.exe'
    CommandLine|contains:
      - 'tauri'
  selection_scheme:
    CommandLine|contains:
      - 'data:text/javascript'
      - 'data:application/javascript'
      - 'blob:'
  condition: selection_tauri and selection_scheme
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate application updates or developer tooling that references blob URLs
level: medium
tags:
  - attack.t1059.007
  - cve.2026.95626

YARA Rule

rule CVE_2026_95626_Tauri_CSP_Scheme_Bypass
{
    meta:
        description = "Detects script content or configuration artifacts referencing data: or blob: as a script source, consistent with the Tauri CSP nonce bypass (CVE-2026-95626)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95626"
        severity = "high"

    strings:
        $csp1 = "script-src" ascii nocase
        $scheme_data = "data:" ascii nocase
        $scheme_blob = "blob:" ascii nocase
        $js_mime1 = "text/javascript" ascii nocase
        $js_mime2 = "application/javascript" ascii nocase
        $nonce = "nonce-" ascii nocase

    condition:
        filesize < 2MB and
        $csp1 and
        ( $scheme_data or $scheme_blob ) and
        ( $js_mime1 or $js_mime2 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95626 Tauri CSP Bypass - data/blob script source in response"; flow:established,to_client; content:"script-src"; http_header; nocase; content:"data:"; http_header; nocase; content:"text/javascript"; http_header; nocase; reference:cve,2026-95626; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95626; classtype:web-application-attack; sid:202695626; rev:1;)

alert http any any -> any any (msg:"CVE-2026-95626 Tauri CSP Bypass - blob script source in response"; flow:established,to_client; content:"script-src"; http_header; nocase; content:"blob:"; http_header; nocase; reference:cve,2026-95626; classtype:web-application-attack; sid:202695627; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.parent.name != null and process.name : "*" and process.command_line : "*tauri*"]
  [process where process.command_line : ("*data:text/javascript*" or "*data:application/javascript*" or "*blob:*")]

Splunk SPL Query

index=endpoint OR index=proxy
(process_command_line="*tauri*" OR http.response.header="*script-src*")
(process_command_line IN ("*data:text/javascript*","*data:application/javascript*","*blob:*")
 OR http.response.header="*data:*" OR http.response.header="*blob:*")
| stats count values(process_command_line) values(http.response.header) by host, user
| where count > 0

Wazuh OSSEC Rule

<group name="tauri,cve,cve_2026_95626,">
  <rule id="2026956" level="10">
    <decoded_as>json</decoded_as>
    <field name="command">\.exe</field>
    <field name="command" type="pcre2">(?i)tauri</field>
    <field name="command" type="pcre2">(?i)(data:text/javascript|data:application/javascript|blob:)</field>
    <description>CVE-2026-95626: Tauri process referencing data:/blob: script source - possible CSP nonce bypass</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>

  <rule id="2026957" level="7">
    <decoded_as>json</decoded_as>
    <field name="http_response_header" type="pcre2">(?i)script-src[^;]*(data:|blob:)</field>
    <description>CVE-2026-95626: CSP script-src includes data:/blob: scheme - weakened Tauri nonce hardening</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory URL, workaround, or affected-version data was provided in the intelligence feed. The guidance below is configuration- and hardening-oriented and does not reference a nonexistent patch.

1) Immediate mitigations.

• Audit and remove scheme sources. Inspect the effective CSP of any Tauri-based application and remove data: and blob: from the script-src directive. Per the CSP Level 3 behavior described in the CVE, these scheme sources override the nonce-based protection; eliminating them restores the intended restriction.
• Prefer explicit allowlists over scheme sources. Where functionality genuinely requires dynamically generated scripts, avoid data:/blob: script sources and instead restructure the feature to use nonce-bearing or hash-bearing scripts only.
• Treat nonce hardening as non-authoritative when scheme sources are present. Until configuration is verified and corrected, do not assume that Tauri's nonce injection is protecting the application if data:/blob: appear in script-src.

2) Patch/upgrade steps.

• No patch is currently available from any tracked source. Monitor the Tauri project's official release channels and security advisories for a fix or an updated CSP-hardening implementation.
• Because the affected version range is unspecified (AFFECTED_VERSION: UNKNOWN), maintain an accurate software bill of materials (SBOM) for applications built with Tauri so that affected deployments can be identified and remediated promptly once a fix ships.
• Apply a vendor patch immediately upon availability, and re-validate the effective CSP after upgrading to confirm scheme sources are no longer honored for script execution.

3) Long-term hardening.

• Adopt strict, allowlist-based CSPs for all Tauri application frontends, avoiding data:/blob: in script-src and related directives.
• Eliminate the injection primitives that make the CSP bypass meaningful — sanitize and encode untrusted data rendered in the webview, and minimize the frontend's exposed IPC surface so that a script-execution foothold does not translate into broad native capability.
• Continuously validate the runtime CSP (not just source configuration), since defaults and framework behavior can change between releases.
• Add detection coverage (see Detection Guidance) to monitor for data:/blob: script sources and scheme-based script execution, and incorporate Tauri applications into supply-chain and configuration-baseline reviews.

References

• NVD — CVE-2026-95626: https://nvd.nist.gov/vuln/detail/CVE-2026-95626
• W3C — Content Security Policy Level 3 (nonce-source and scheme-source semantics for script-src): https://www.w3.org/TR/CSP3/
• Tauri project — official documentation and security advisories (CSP configuration and hardening): https://tauri.app/
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html

No threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-95626 in the provided data. The CVE is not listed in CISA KEV, has no public PoC or exploit code, and has no Nuclei template as of this report.