CVE-2026-95624
Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
| CWE | CWE-284 |
| Vendor | tauri |
| Product | tauri-plugin-updater |
| Published | Sep 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for tauri tauri-plugin-updater
Be the first to know when new medium vulnerabilities affecting tauri tauri-plugin-updater are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
Tauri / tauri-plugin-updater
2.8.0 < 2.12.0
References
github.com: https://github.com/tauri-apps/tauri/security/advisories/GHSA-rjc6-5hfg-grp9 github.com: https://github.com/tauri-apps/tauri github.com: https://github.com/tauri-apps/plugins-workspace/commit/1308bfa399b962b3977c767100a6339d1cbfdd20 github.com: https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0
Credits
Yuval Moravchick JFrog Security Research