CVE-2026-95625

Name of the Vulnerable Software and Affected Versions Tauri (affected versions not specified)

Description The updater plugin verifies update binaries using minisign signatures, but the signature only covers the raw binary bytes. The update manifest, which includes the version number, download URL, and signature, is fetched over TLS but is not signed or authenticated. Since the anti-rollback check relies on the unsigned version field in the manifest, an attacker capable of serving a crafted manifest can force the installation of any older signed release without needing the developer's private key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.