# CVE-2026-95627: Tauri dialog plugin scope expansion via XSS

Source: https://junglewise.ai/threats/cve-2026-95627-when-a-tauri-application-uses-the-dialog-plugin-s-file-or-folder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-95627 · Severity: high · CVSS 7.7 · Published 2026-09-23

Tauri is a framework for building desktop applications with web technologies. When a Tauri app uses the dialog plugin's file or folder picker, an attacker who gains JavaScript execution (such as through XSS) can trick users into granting recursive read/write access to entire directory trees with a single click on a normal file dialog. Users receive no warning that expanded access was granted and cannot revoke it for the application's lifetime, potentially exposing sensitive files.

Vendors: [Tauri](https://junglewise.ai/threats/vendors/tauri).

## Quick answers

**Is CVE-2026-95627 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95627 being exploited in the wild.

**How severe is CVE-2026-95627?** High severity, with a CVSS score of 7.7, published 23 September 2026.

**Which products and versions are affected?** Tauri Dialog Plugin <UNKNOWN>.

**Is there a fix for CVE-2026-95627?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95627 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95627?** Check whether you run Tauri Dialog Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Tauri's dialog plugin when handling file or folder picker scopes. An attacker with JavaScript execution in the application context can manipulate the scope expansion logic to become recursive, escalating a user-authorized access grant from a single directory to all subdirectories. The attack requires XSS (or equivalent JavaScript execution) as a precondition, but the resulting scope expansion is persistent and cannot be revoked at runtime.

## Affected products

- Tauri dialog plugin <UNKNOWN>

## Timeline

- 2026-09-23: disclosed

## References

- [https://crates.io/crates/tauri-plugin-dialog](https://crates.io/crates/tauri-plugin-dialog)
- [https://github.com/tauri-apps/plugins-workspace](https://github.com/tauri-apps/plugins-workspace)