CVE-2026-95624

Medium

Description

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.

SeverityMedium

CVSS6.8

Exploit probability—

ProductTauri-plugin-updater

PublishedSep 22, 2026

First seenSep 22, 2026

Weakness typeCWE-284Improper access control

How to fix

Update

Tauri tauri-plugin-updater2.12.0 or later

Patches

github.com/tauri-apps/plugins-workspace/commit/1308bfa399b962b3977c767100a6339d1cbfdd20

Vendor advisories

github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0

Affected products

Product	Affected versions	Fixed in
Tauri tauri-plugin-updater	2.8.0 ≤ v < 2.12.0	2.12.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.