TI-2026-63657 Aliases CVE-2026-95624 GHSA-wqjv-7vqv-x3mj

Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

LOW 32CWE-284Published 2026-09-22 · Updated 2026-09-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00449 39th percentileScored 2026-11-07

Fix Fixed tauri-plugin-updater (Tauri): 2.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tauri-apps	tauri-plugin-updater	2.8.0 to before 2.12.0	2.12.0	Patch available	CNA

tauri-plugin-updater Vendortauri-apps Affected 2.8.0 to before 2.12.0 Fixed in 2.12.0 Patch available CNA

Remediation

Fix · CNA tauri-plugin-updater (Tauri) Fixed in 2.12.0

Timeline

2026-10-02 Threatist record created from CVE-2026-95624
2026-10-03 Alias added: GHSA-wqjv-7vqv-x3mj

References

Patch 1

Move allowDowngrades from the check command to the plugin configuration

Other 3

TI-2025-22658 Improper Scope Validation in the open Endpoint of tauri-plugin-shell CVSS 4.0CRITICAL 9.3
TI-2022-18594 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri CVSS 3.1HIGH 8.3
TI-2023-24757 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli CVSS 3.1HIGH 8.4
TI-2022-22815 Tauri vulnerable to path traversal CVSS 3.1HIGH 7.7
TI-2026-30506 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands CVSS 4.0MEDIUM 6.1
TI-2024-23292 iFrames Bypass Origin Checks for Tauri API Access Control CVSS 3.1MEDIUM 5.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences