CVE-2026-47122 Details
Description
Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.
A vulnerability exists in the Sparkle software update framework for macOS, specifically in versions through 2.9.1. The issue arises in the `Autoupdate/AppInstaller.m` file, where the `shouldAcceptNewConnection:` method only applies code signing verification before the first installation stage is completed. Once the first stage is finished, the application accepts new connections to the Mach service from any local process, bypassing team-ID and code-signing requirements. This flaw allows for the injection of spoofed appcast item data into Sparkle-aware applications.
To address this vulnerability, the `SUCodeSigningVerifier validateConnection:` method should be enforced on all new connections, regardless of the installation stage. Alternatively, the `SPUSentUpdateAppcastItemData` message could be disallowed after the active connection is invalidated.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-g3hp-f6mg-559v | [email protected] | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sparkle-project sparkle | <= 2.9.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |