CVE-2026-95625 Details
Description
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
A vulnerability in the Tauri updater plugin could allow an attacker to force the installation of an older version of a software application. This issue arises because the plugin verifies update binaries using minisign signatures, which only cover the raw binary bytes. While the update manifest is fetched over TLS, it is not signed or authenticated. An attacker could exploit this by serving a crafted manifest that tricks the updater into installing a previous release that is still signed, effectively bypassing version control measures.
Users can update to Tauri Updater Plugin version 2.12.0, which includes a new 'requireSignedVersion' option that binds an update to the version it was signed for, preventing such downgrade attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tauri-apps/plugins-workspace | [email protected] | Vendor |
| https://github.com/tauri-apps/plugins-workspace/commit/690dcfd694 | [email protected] | Source CodeVendor |
| https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0 | [email protected] | Release NotesVendor |
| https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-j38x-g3m3-95fr | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-354 | Improper Validation of Integrity Check Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tauri updater | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |