---
id: CVE-2026-95627
title: >-
  When a Tauri application uses the dialog plugin's file or folder picker, an
  attacker with JavaScript execution (XSS) can force the scope expansion to be
  recursive, granting read/write access to an entire directory tree after a
  single use…
summary: >-
  When a Tauri application uses the dialog plugin's file or folder picker, an
  attacker with JavaScript execution (XSS) can force the scope expansion to be
  recursive, granting read/write access to an entire directory tree after a
  single use…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-732
vendor: Tauri
product: tauri-plugin-dialog
affected:
  - tauri-plugin-dialog >= 2.0.0 <= *
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T19:42:02.350'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-95627'
references:
  - url: 'https://github.com/tauri-apps/plugins-workspace'
    label: reefs@jfrog.com
  - url: >-
      https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-vw89-89jm-wmqc
    label: reefs@jfrog.com
tags:
  - nvd
  - cve.org
epss: 0.00202
epssPercentile: 0.08968
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-23T14:21:31.658846Z'
ingestedAt: '2026-09-23T10:21:54.377Z'
---

## Overview

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.