CVE-2025-31477

Tauri Plugin-shell remote code execution

9.8 CRITICALEPSS 1.04%

Published2 Apr 2025

Description

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Tauri Plugin-shell< 2.2.1

Remediation

Fixed in

Tauri Plugin-shell≥ 2.2.1

Frequently asked

Is CVE-2025-31477 being actively exploited?

CVE-2025-31477 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.04%.

How severe is CVE-2025-31477?

CVE-2025-31477 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 1.04% probability of exploitation.

Which products are affected by CVE-2025-31477?

Affected products include Tauri Plugin-shell.

How do I fix CVE-2025-31477?

Upgrade affected software to a fixed version, for example Tauri Plugin-shell 2.2.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-31477 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.