The @capgo/capacitor-updater package versions prior to 12.128.2 have a cryptographic design flaw where the private key is distributed to every device downloading the app. Because the public key is derivable from the private key, an attacker with network interception capabilities or server compromise can forge update bundles that appear validly signed. This undermines the integrity of the update mechanism and allows unauthorized code execution through malicious updates.

An attacker capable of intercepting communications or compromising the Capgo server can produce malicious update bundles that devices will accept as legitimate. This can lead to unauthorized code execution on affected devices by installing updates not created by the original app developer, potentially compromising device security and user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of @capgo/capacitor-updater or restrict update mechanisms to trusted networks to reduce the risk of man-in-the-middle attacks.