Threats affecting pkg:cargo/tauri-plugin-updater

CVE-2026-95625 is a vulnerability in the Tauri tauri-plugin-updater where the update manifest is not signed or authenticated, allowing an attacker to serve a crafted manifest. This can force the installation of older signed releases despite the anti-rollback check, which only compares an unsigned version field. The vulnerability affects versions >=2.0.0 and later. The CVSS score is 5.9, indicating medium severity.

CVE-2026-95624 is an improper access control vulnerability in the Tauri tauri-plugin-updater. The updater's 'check' IPC command accepts an allowDowngrades boolean parameter from frontend JavaScript, which can be exploited via XSS to bypass anti-rollback protections and enable downgrade attacks. This affects versions from 2.8.0 up to but not including 2.12.0. The vulnerability has a medium severity with a CVSS score of 6.8.