Skip to content
OpenAdvisories

Product · Tauri

tauri-plugin-updater

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-95625

    Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade

    The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself s…

    Tauri tauri-plugin-updater minisign Ubuntu
  • Medium 6.8
    CVE-2026-95624

    Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

    The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the def…

    Tauri tauri-plugin-updater