Skip to content
OpenAdvisories

Vendor

sparkle-project

5 known vulnerabilities.

Products

Sparkle 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-47122

    Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

    Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Inst…

    sparkle-project Sparkle github.com/sparkle-project/Sparkle SwiftURL
  • Medium 6.1
    CVE-2026-47121

    Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

    Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not…

    sparkle-project Sparkle github.com/sparkle-project/Sparkle SwiftURL
  • Medium 4.8
    CVE-2025-10015

    TCC Bypass via Downloader XPC Service in Sparkle

    The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. L…

    sparkle-project Sparkle