The Tauri updater plugin uses minisign signatures to verify update binaries, but the signature does not cover the update manifest. The manifest, containing the version number, download URL, and signature, is retrieved over TLS but lacks its own signature or authentication. The anti-rollback check relies solely on comparing the manifest's unsigned version field against the current version. Consequently, an attacker capable of serving a manipulated manifest can cause the updater to install any older signed release without needing the developer's private key.

An attacker who can intercept or manipulate the update manifest can bypass anti-rollback protections and force the installation of older, potentially vulnerable versions of the software. This can lead to downgrade attacks that may expose users to previously fixed vulnerabilities or other security issues. The confidentiality, integrity, and availability of the system may be impacted due to forced installation of outdated software versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about the source of update manifests and consider additional verification mechanisms outside the plugin. Monitoring vendor communications for updates or patches is recommended.