The vulnerability arises because the Tauri framework injects a random nonce to harden its Content Security Policy, yet it fails to neutralize scripts loaded from data: or blob: schemes. Consequently, any script that sources from these schemes can execute regardless of the nonce. This bypass enables an attacker to inject malicious JavaScript through those schemes, resulting in a cross‑site scripting attack that can subsequently be chained into remote code execution on the host machine, exposing confidentiality, integrity, and availability of the system.

Tauri framework version 2 and any application built with it that includes data: or blob: in its script-src directive is affected. No specific version range is provided, so all v2 releases that do not address this issue remain vulnerable.

The CVSS score of 8.3 classifies the flaw as high severity, but the EPSS score of less than 1% indicates that exploitation likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply code that is loaded via a data: or blob: URI within the application; once executed, they can execute arbitrary commands on the system. The attack vector can be local or remote, depending on how the application procures these schemes, but the specific method of delivery is not detailed in the advisory.