Executive brief
The Tauri updater plugin verifies downloaded application updates using cryptographic signatures but does not authenticate the version information and download URLs in the update manifest. An attacker intercepting manifest delivery can trick users into installing older versions of the application, potentially bypassing security patches and exposing systems to previously fixed vulnerabilities.
Technical details
The vulnerability exists in the Tauri updater plugin's manifest handling: while binary payloads are verified with minisign signatures, the manifest itself (containing version, URL, and signature hash) is fetched over TLS but never cryptographically signed. The anti-rollback mechanism relies solely on comparing unsigned version fields, allowing an attacker to serve a manifest pointing to any previously signed release. This requires network-level access to intercept or redirect manifest delivery.
Affected products
- Tauri tauri-plugin-updater
Timeline
- 2026-09-23: disclosed