Is CVE-2026-95624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95624 being exploited in the wild.

How severe is CVE-2026-95624?

Medium severity, with a CVSS score of 6.8, published 22 September 2026.

Is there a fix for CVE-2026-95624?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95624 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95624?

Check whether you run Tauri-Plugin-Updater. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95624: Tauri updater plugin downgrade attack via allowDowngrades bypass

CVE-2026-95624 · Severity: medium · CVSS 6.8 · Published 2026-09-22

The Tauri updater plugin allows frontend JavaScript code to bypass rollback protection by setting an allowDowngrades parameter to true, which disables version checks. An attacker exploiting an XSS vulnerability in a Tauri application can invoke this to downgrade the app to an older, vulnerable version without needing to fake a higher version number. This could allow installation of malicious code or restoration of patched vulnerabilities.

Vendors: Tauri.

Quick answers

Is CVE-2026-95624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95624 being exploited in the wild.
How severe is CVE-2026-95624?: Medium severity, with a CVSS score of 6.8, published 22 September 2026.
Which products and versions are affected?: Tauri tauri-plugin-updater.
Is there a fix for CVE-2026-95624?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95624 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95624?: Check whether you run Tauri-Plugin-Updater. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The updater's 'check' IPC command accepts an allowDowngrades boolean parameter from untrusted frontend code, which bypasses the normal "update must be newer" version comparator. Default permissions grant allow-check to the webview, so any XSS in the frontend can trigger downgrade attacks. When combined with a secondary vulnerability, this enables full rollback without version spoofing.

Affected products

Tauri tauri-plugin-updater

Timeline

2026-09-22: disclosed: CVE-2026-95624 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.