PT-2026-45020 · Sparkle+2 · Sparkle+1
CVE-2026-47122
·
Published
2026-05-29
·
Updated
2026-07-21
CVSS v3.1
4.2
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Sparkle versions 2.x through 2.9.1
Description
In the
Autoupdate/AppInstaller.m file, the shouldAcceptNewConnection: function only enforces SUCodeSigningVerifier validateConnection: before the first stage of installation completes. Once performedStage1Installation is set to YES, new connections to the registered Mach service <bundleId>-spki are accepted from any local process without team-ID or code-signing checks. This allows a local user-level process to inject a spoofed SPUSentUpdateAppcastItemData payload containing an attacker-crafted SUAppcastItem. If a Sparkle-aware app launches before installation completes, it may display attacker-controlled release notes, including the name, version, and critical flag. In cases where SPUUsesSystemDomainForBundlePath is true, the AppInstaller runs as root, making the Mach service reachable by any local user process. The integrity of the installed code remains unaffected as the bundle is signature-validated during stage 1; the impact is limited to UI spoofing of installation metadata.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sparkle
Github.Com/Sparkle-Project/Sparkle