Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-95625— Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade

Quick assessment

Affected
Tauri tauri-plugin-updater
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself si

CVSS 5.9 · Medium EPSS 0.22% · P13
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-95625

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
Source: CVE Program / CVE List V5
Vulnerability Description
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Tauri tauri-plugin-updater 2.0.0 ~ 2.12.0 -

II. Public POCs for CVE-2026-95625

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-95625

请登录查看更多情报信息。

Other References for CVE-2026-95625 (3)

Same Patch Batch · Tauri · 2026-09-23 · 3 CVEs total

CVE-2026-95626 8.3 HIGH Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS
CVE-2026-95627 7.7 HIGH Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlle

IV. Related Vulnerabilities

Same product: tauri-plugin-updater
Same vendor: Tauri
Same weakness: CWE-354

V. Comments for CVE-2026-95625

No comments yet

Leave a comment