diff --git a/crates/tauri/RUSTSEC-0000-0000.md b/crates/tauri/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..4e18688 --- /dev/null +++ b/crates/tauri/RUSTSEC-0000-0000.md @@ -0,0 +1,20 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "tauri" +date = "2022-09-19" +url = "https://github.com/tauri-apps/tauri/issues/5234" +categories = ["privilege-escalation"] +aliases = ["CVE-2022-41874", "GHSA-q9wv-22m9-vhqh"] +cvss = "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N" + +[versions] +patched = [">= 1.0.7, < 1.1.0", ">= 1.1.2"] +unaffected = ["< 1.0.0"] +``` + +# `tauri` filesystem scope partial bypass + +A bug identified in [this](https://github.com/tauri-apps/tauri/issues/5234) issue allows a partial filesystem scope bypass if glob characters are used within file dialog or drag-and-drop functionalities. + +[This](https://github.com/tauri-apps/tauri/pull/5237) PR fixes the issue by escaping glob characters.