Skip to content
OpenAdvisories

Package · SwiftURL

github.com/sparkle-project/Sparkle

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-47122

    Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

    Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Inst…

    sparkle-project Sparkle github.com/sparkle-project/Sparkle SwiftURL
  • Medium 6.1
    CVE-2026-47121

    Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

    Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not…

    sparkle-project Sparkle github.com/sparkle-project/Sparkle SwiftURL