CVE-2026-95624

Name of the Vulnerable Software and Affected Versions Tauri (affected versions not specified)

Description The updater plugin contains a flaw where the 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When this parameter is set to true, the version comparison logic changes from requiring a newer version to simply requiring a different version. Since the default permission set allows the webview to execute the check command, a Cross-Site Scripting (XSS) attack in the app frontend can trigger this command to bypass anti-rollback protections, potentially enabling downgrade attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.