rclone versions from 1.55.0 up to but not including 1.75.2 contain a vulnerability in the stable selfupdate mechanism. The flaw allows an attacker controlling the release distribution path to bypass signature verification by prepending an unsigned checksum line that matches a malicious archive. This causes the selfupdate process to install a malicious rclone executable. The issue is fixed in version 1.75.2.