tauri-plugin-updater vulnerabilities
CVEs whose affected-version data names the tauri-plugin-updater package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-95625Medium· 5.9The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS…
▾ SunlitTauri · tauri-plugin-updaterEPSS 0.22%via NVD
CVE-2026-95624Medium· 6.8The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be diffe…
▾ SunlitTauri · tauri-plugin-updaterEPSS 0.45%via NVD