Tauri Updater Plugin Vulnerability in Tauri Applications

CVE-2026-95625

What is CVE-2026-95625?

The Tauri updater plugin utilizes minisign signatures to verify update binaries, but the signature validation applies only to the binary's raw bytes. While the update manifest is retrieved over a secure TLS connection, it remains unsigned and unauthenticated. As a result, attackers can exploit this flaw by serving a malicious manifest that can bypass the anti-rollback checks, allowing them to force the installation of any older version of the signed release without the need for the developer's private key.

References