CVE-2025-31477 is a Critical severity (CVSS 9.8) input validation flaw in the Tauri shell plugin. Its open endpoint did not properly restrict protocols such as file, smb and nfs. Versions up to 2.2.0 are affected and 2.2.1 is the fix, for both the npm and Rust packages.
What's affected
The GitHub advisory lists two packages, both affected up to and including 2.2.0 and patched in 2.2.1:
@tauri-apps/plugin-shellon npmtauri-plugin-shellon crates.io (Rust)
The issue sits in the open endpoint, which is meant to open links with the system's default handler, such as xdg-open on Linux. It was supposed to be limited by default to a small set of protocols such as https and mailto. That default restriction did not work because of improper validation of the allowed protocols. As a result, protocols like file, smb and nfs could be passed to the system's registered handler.
The advisory says that when untrusted input is passed to the open endpoint, these protocols can be abused to gain remote code execution on the system. It also states the precondition: the endpoint must be exposed directly to application users, or an attacker must already have code execution in the frontend of the app. The weakness is CWE-20. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record does not mark the CVE as in CISA KEV.
You are not affected if you explicitly configured a validation regex or manually set the plugin's open value to true, which limits it to mailto, http and https.
How to check if you're exposed
Find the shell plugin in each Tauri app you build or ship. For the JavaScript side:
npm ls @tauri-apps/plugin-shell
For the Rust side, from the app's src-tauri directory:
cargo tree -i tauri-plugin-shell
If the version is 2.2.0 or lower, the dependency is affected. Then look at your configuration. Open tauri.conf.json and read the plugins section for a shell entry:
grep -n -A3 '"shell"' src-tauri/tauri.conf.json
If it sets open to a validation regex or to true, the advisory says you are not affected. Also check your capability files for shell:default and shell:allow-open, since those grant the frontend access to the endpoint.
Finally, search your frontend code for calls to the shell plugin's open function and see whether any of them pass a value that came from a user, a remote page or a document.
What to do now
- Update both
@tauri-apps/plugin-shellandtauri-plugin-shellto 2.2.1 or later, then rebuild and ship a new app version. - Set the shell plugin's
openoption to true intauri.conf.json. The advisory says this allows only mailto, http and https links. - If the app does not need the open endpoint, remove
shell:defaultand everyshell:allow-openentry from your capabilities, or set a regex that matches nothing. - Consider the
openerplugin. The advisory notes that the shell plugin deprecated the open endpoint and recommends the opener plugin instead. - Never pass untrusted text straight to an open call, and treat any frontend code execution bug in your app as a path to this one.
Why it matters
The system opener is a convenience: give it a link and the operating system picks a program to handle it. That is safe for web links. It becomes dangerous when the link scheme points at local files or network shares, because the handler may run a program or load a file in a way the user did not expect. The plugin had a check meant to prevent this, but the check did not work, so the default configuration was weaker than the documentation suggested. This is %s in its simplest form: a check that exists but does not check the right thing.
The high score reflects the worst case, which is code execution. The advisory's preconditions matter in practice, because they say the endpoint must be reachable by untrusted input or the attacker must already control frontend code. For desktop apps built on web technology, that second condition links this bug to cross site scripting, so the two should be reviewed together.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which packages do I need to update?
Both the npm package @tauri-apps/plugin-shell and the Rust crate tauri-plugin-shell, to 2.2.1 or later, since the advisory lists both.
Am I safe if I set the open option to true?
The advisory says setting open to true allows only mailto, http and https links, and that setting a validation regex has the same protective effect. Updating is still the cleaner fix.
Sources
Last reviewed: 19 October 2026.
