{"id":"CVE-2026-95625","summary":"Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade","details":"The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.","aliases":["GHSA-j38x-g3m3-95fr"],"modified":"2026-09-24T03:47:33.033902Z","published":"2026-09-23T08:51:53.922Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"2.12.0"},{"last_affected":"*"}]}],"cna_assigner":"JFROG","cwe_ids":["CWE-354"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95625.json"},"references":[{"type":"PACKAGE","url":"git://github.com/tauri-apps/plugins-workspace"},{"type":"WEB","url":"https://crates.io/crates/tauri-plugin-updater"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95625.json"},{"type":"PACKAGE","url":"https://github.com/tauri-apps/plugins-workspace"},{"type":"FIX","url":"https://github.com/tauri-apps/plugins-workspace/commit/690dcfd694"},{"type":"ADVISORY","url":"https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0"},{"type":"REPORT","url":"https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-j38x-g3m3-95fr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95625"}],"affected":[{"ranges":[{"type":"GIT","repo":"git://github.com/tauri-apps/plugins-workspace","events":[{"introduced":"e8069af80401cfc1e90297b786bef05a929ed9a6"},{"fixed":"5baf71a47292d8490f0ba3d53f15224e55c48327"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.12.0"}],"source":"AFFECTED_FIELD"}}],"versions":["store-v2.4.5","store-js-v2.4.5","http-v2.6.1","http-js-v2.6.1","websocket-v2.4.3","websocket-js-v2.4.3","upload-v2.4.1","upload-js-v2.4.1","updater-v2.11.0","updater-js-v2.11.0","stronghold-v2.3.2","stronghold-js-v2.3.2","sql-v2.4.1","sql-js-v2.4.1","single-instance-v2.4.4","shell-v2.3.6","shell-js-v2.3.6","positioner-v2.3.4","positioner-js-v2.3.4","persisted-scope-v2.3.8","opener-v2.5.5","opener-js-v2.5.5","notification-v2.4.0","notification-js-v2.4.0","nfc-v2.3.6","nfc-js-v2.3.6","log-v2.9.1","log-js-v2.9.1","http-v2.6.0","http-js-v2.6.0","haptics-v2.3.3","haptics-js-v2.3.3","geolocation-v2.3.3","geolocation-js-v2.3.3","fs-v2.5.2","fs-js-v2.5.2","dialog-v2.7.3","dialog-js-v2.7.3","deep-link-v2.4.10","deep-link-js-v2.4.10","clipboard-manager-v2.3.3","clipboard-manager-js-v2.3.3","biometric-v2.3.3","biometric-js-v2.3.3","barcode-scanner-v2.4.6","barcode-scanner-js-v2.4.6","store-v2.4.4","store-js-v2.4.4","dialog-v2.7.2","dialog-js-v2.7.2","single-instance-v2.4.3","positioner-v2.3.3","positioner-js-v2.3.3","log-v2.9.0","log-js-v2.9.0","positioner-v2.3.2","positioner-js-v2.3.2","global-shortcut-v2.3.2","global-shortcut-js-v2.3.2","barcode-scanner-v2.4.5","barcode-scanner-js-v2.4.5","store-v2.4.3","store-js-v2.4.3","single-instance-v2.4.2","persisted-scope-v2.3.7","opener-v2.5.4","opener-js-v2.5.4","http-v2.5.9","http-js-v2.5.9","fs-v2.5.1","fs-js-v2.5.1","dialog-v2.7.1","dialog-js-v2.7.1","deep-link-v2.4.9","deep-link-js-v2.4.9","updater-v2.10.1","updater-js-v2.10.1","sql-v2.4.0","sql-js-v2.4.0","single-instance-v2.4.1","persisted-scope-v2.3.6","nfc-v2.3.5","nfc-js-v2.3.5","http-v2.5.8","http-js-v2.5.8","fs-v2.5.0","fs-js-v2.5.0","dialog-v2.7.0","dialog-js-v2.7.0","deep-link-v2.4.8","deep-link-js-v2.4.8","single-instance-v2.4.0","deep-link-v2.4.7","deep-link-js-v2.4.7","updater-v2.10.0","updater-js-v2.10.0","sql-v2.3.2","sql-js-v2.3.2","shell-v2.3.5","shell-js-v2.3.5","http-v2.5.7","http-js-v2.5.7","barcode-scanner-v2.4.4","barcode-scanner-js-v2.4.4","http-v2.5.6","http-js-v2.5.6","dialog-v2.6.0","dialog-js-v2.6.0","websocket-v2.4.2","websocket-js-v2.4.2","upload-v2.4.0","upload-js-v2.4.0","store-v2.4.2","store-js-v2.4.2","single-instance-v2.3.7","shell-v2.3.4","shell-js-v2.3.4","persisted-scope-v2.3.5","opener-v2.5.3","opener-js-v2.5.3","nfc-v2.3.4","nfc-js-v2.3.4","log-v2.8.0","log-js-v2.8.0","localhost-v2.3.2","http-v2.5.5","http-js-v2.5.5","fs-v2.4.5","fs-js-v2.4.5","dialog-v2.5.0","dialog-js-v2.5.0","deep-link-v2.4.6","deep-link-js-v2.4.6","barcode-scanner-v2.4.3","barcode-scanner-js-v2.4.3","window-state-v2.4.1","window-state-js-v2.4.1","websocket-v2.4.1","websocket-js-v2.4.1","upload-v2.3.2","upload-js-v2.3.2","stronghold-v2.3.1","stronghold-js-v2.3.1","store-v2.4.1","store-js-v2.4.1","sql-v2.3.1","sql-js-v2.3.1","single-instance-v2.3.6","shell-v2.3.3","shell-js-v2.3.3","process-v2.3.1","process-js-v2.3.1","positioner-v2.3.1","positioner-js-v2.3.1","persisted-scope-v2.3.4","os-v2.3.2","os-js-v2.3.2","opener-v2.5.2","opener-js-v2.5.2","notification-v2.3.3","notification-js-v2.3.3","nfc-v2.3.3","nfc-js-v2.3.3","log-v2.7.1","log-js-v2.7.1","localhost-v2.3.1","http-v2.5.4","http-js-v2.5.4","haptics-v2.3.2","haptics-js-v2.3.2","global-shortcut-v2.3.1","global-shortcut-js-v2.3.1","geolocation-v2.3.2","geolocation-js-v2.3.2","fs-v2.4.4","fs-js-v2.4.4","dialog-v2.4.2","dialog-js-v2.4.2","deep-link-v2.4.5","deep-link-js-v2.4.5","clipboard-manager-v2.3.2","clipboard-manager-js-v2.3.2","cli-v2.4.1","cli-js-v2.4.1","biometric-v2.3.2","biometric-js-v2.3.2","barcode-scanner-v2.4.2","barcode-scanner-js-v2.4.2","autostart-v2.5.1","autostart-js-v2.5.1","single-instance-v2.3.5","shell-v2.3.2","shell-js-v2.3.2","persisted-scope-v2.3.3","opener-v2.5.1","opener-js-v2.5.1","notification-v2.3.2","notification-js-v2.3.2","nfc-v2.3.2","nfc-js-v2.3.2","http-v2.5.3","http-js-v2.5.3","haptics-v2.3.1","haptics-js-v2.3.1","geolocation-v2.3.1","geolocation-js-v2.3.1","fs-v2.4.3","fs-js-v2.4.3","dialog-v2.4.1","dialog-js-v2.4.1","deep-link-v2.4.4","deep-link-js-v2.4.4","clipboard-manager-v2.3.1","clipboard-manager-js-v2.3.1","biometric-v2.3.1","biometric-js-v2.3.1","barcode-scanner-v2.4.1","barcode-scanner-js-v2.4.1","single-instance-v2.3.4","log-v2.7.0","log-js-v2.7.0","dialog-v2.4.0","dialog-js-v2.4.0","deep-link-v2.4.3","deep-link-js-v2.4.3","shell-v2.3.1","shell-js-v2.3.1","single-instance-v2.3.3","notification-v2.3.1","notification-js-v2.3.1","deep-link-v2.4.2","deep-link-js-v2.4.2","store-v2.4.0","store-js-v2.4.0","persisted-scope-v2.3.2","os-v2.3.1","os-js-v2.3.1","opener-v2.5.0","opener-js-v2.5.0","nfc-v2.3.1","nfc-js-v2.3.1","http-v2.5.2","http-js-v2.5.2","fs-v2.4.2","fs-js-v2.4.2","dialog-v2.3.3","dialog-js-v2.3.3","dialog-v2.3.2","dialog-js-v2.3.2","single-instance-v2.3.2","deep-link-v2.4.1","deep-link-js-v2.4.1","window-state-v2.4.0","window-state-js-v2.4.0","upload-v2.3.1","upload-js-v2.3.1","single-instance-v2.3.1","persisted-scope-v2.3.1","http-v2.5.1","http-js-v2.5.1","fs-v2.4.1","fs-js-v2.4.1","dialog-v2.3.1","dialog-js-v2.3.1","barcode-scanner-v2.4.0","barcode-scanner-js-v2.4.0","window-state-v2.3.0","window-state-js-v2.3.0","websocket-v2.4.0","websocket-js-v2.4.0","upload-v2.3.0","upload-js-v2.3.0","updater-v2.9.0","updater-js-v2.9.0","stronghold-v2.3.0","stronghold-js-v2.3.0","store-v2.3.0","store-js-v2.3.0","sql-v2.3.0","sql-js-v2.3.0","single-instance-v2.3.0","shell-v2.3.0","shell-js-v2.3.0","process-v2.3.0","process-js-v2.3.0","positioner-v2.3.0","positioner-js-v2.3.0","persisted-scope-v2.3.0","os-v2.3.0","os-js-v2.3.0","opener-v2.4.0","opener-js-v2.4.0","notification-v2.3.0","notification-js-v2.3.0","nfc-v2.3.0","nfc-js-v2.3.0","log-v2.6.0","log-js-v2.6.0","localhost-v2.3.0","http-v2.5.0","http-js-v2.5.0","haptics-v2.3.0","haptics-js-v2.3.0","global-shortcut-v2.3.0","global-shortcut-js-v2.3.0","geolocation-v2.3.0","geolocation-js-v2.3.0","fs-v2.4.0","fs-js-v2.4.0","dialog-v2.3.0","dialog-js-v2.3.0","deep-link-v2.4.0","deep-link-js-v2.4.0","clipboard-manager-v2.3.0","clipboard-manager-js-v2.3.0","cli-v2.4.0","cli-js-v2.4.0","biometric-v2.3.0","biometric-js-v2.3.0","barcode-scanner-v2.3.0","barcode-scanner-js-v2.3.0","autostart-v2.5.0","autostart-js-v2.5.0","opener-v2.3.1","opener-js-v2.3.1","log-v2.5.1","log-js-v2.5.1","cli-v2.3.0","cli-js-v2.3.0","updater-v2.8.1","updater-js-v2.8.1","window-state-v2.2.3","window-state-js-v2.2.3","websocket-v2.3.1","websocket-js-v2.3.1","upload-v2.2.2","upload-js-v2.2.2","updater-v2.8.0","updater-js-v2.8.0","stronghold-v2.2.1","stronghold-js-v2.2.1","store-v2.2.1","store-js-v2.2.1","sql-v2.2.1","sql-js-v2.2.1","shell-v2.2.2","shell-js-v2.2.2","process-v2.2.2","process-js-v2.2.2","positioner-v2.2.1","positioner-js-v2.2.1","os-v2.2.2","os-js-v2.2.2","opener-v2.3.0","opener-js-v2.3.0","notification-v2.2.3","notification-js-v2.2.3","nfc-v2.2.1","nfc-js-v2.2.1","log-v2.5.0","log-js-v2.5.0","localhost-v2.2.1","haptics-v2.2.5","haptics-js-v2.2.5","geolocation-v2.2.5","geolocation-js-v2.2.5","clipboard-manager-v2.2.3","clipboard-manager-js-v2.2.3","cli-v2.2.1","cli-js-v2.2.1","biometric-v2.2.2","biometric-js-v2.2.2","barcode-scanner-v2.2.1","barcode-scanner-js-v2.2.1","autostart-v2.4.0","autostart-js-v2.4.0","single-instance-v2.2.4","persisted-scope-v2.2.2","opener-v2.2.7","opener-js-v2.2.7","http-v2.4.4","http-js-v2.4.4","global-shortcut-v2.2.1","global-shortcut-js-v2.2.1","fs-v2.3.0","fs-js-v2.3.0","dialog-v2.2.2","dialog-js-v2.2.2","deep-link-v2.3.0","deep-link-js-v2.3.0","updater-v2.7.1","updater-js-v2.7.1","log-v2.4.0","log-js-v2.4.0","biometric-v2.2.1","biometric-js-v2.2.1","window-state-v2.2.2","window-state-js-v2.2.2","updater-v2.7.0","updater-js-v2.7.0","single-instance-v2.2.3","shell-v2.2.1","shell-js-v2.2.1","process-v2.2.1","process-js-v2.2.1","persisted-scope-v2.2.1","http-v2.4.3","http-js-v2.4.3","fs-v2.2.1","fs-js-v2.2.1","dialog-v2.2.1","dialog-js-v2.2.1","deep-link-v2.2.1","deep-link-js-v2.2.1","autostart-v2.3.0","autostart-js-v2.3.0","updater-v2.6.1","updater-js-v2.6.1","http-v2.4.2","http-js-v2.4.2","http-v2.4.1","http-js-v2.4.1","log-v2.3.1","log-js-v2.3.1","updater-v2.6.0","updater-js-v2.6.0","os-v2.2.1","os-js-v2.2.1","notification-v2.2.2","notification-js-v2.2.2","log-v2.3.0","log-js-v2.3.0","http-v2.4.0","http-js-v2.4.0","haptics-v2.2.4","haptics-js-v2.2.4","geolocation-v2.2.4","geolocation-js-v2.2.4","clipboard-manager-v2.2.2","clipboard-manager-js-v2.2.2","opener-v2.2.6","opener-js-v2.2.6","log-v2.2.3","log-js-v2.2.3","updater-v2.5.1","updater-js-v2.5.1","single-instance-v2.2.2","log-v2.2.2","log-js-v2.2.2","updater-v2.5.0","updater-js-v2.5.0","websocket-v2.3.0","websocket-js-v2.3.0","updater-v2.4.0","updater-js-v2.4.0","log-v2.2.1","log-js-v2.2.1","http-v2.3.0","http-js-v2.3.0","clipboard-manager-v2.2.1","clipboard-manager-js-v2.2.1","window-state-v2.2.1","window-state-js-v2.2.1","opener-v2.2.5","opener-js-v2.2.5","haptics-v2.2.3","haptics-js-v2.2.3","geolocation-v2.2.3","geolocation-js-v2.2.3","single-instance-v2.2.1","opener-v2.2.4","opener-js-v2.2.4","notification-v2.2.1","notification-js-v2.2.1","haptics-v2.2.2","haptics-js-v2.2.2","geolocation-v2.2.2","geolocation-js-v2.2.2","haptics-v2.2.1","haptics-js-v2.2.1","geolocation-v2.2.1","geolocation-js-v2.2.1","websocket-v2.2.1","websocket-js-v2.2.1","updater-v2.3.1","updater-js-v2.3.1","opener-v2.2.3","opener-js-v2.2.3","opener-v2.2.2","opener-js-v2.2.2","updater-v2.3.0","updater-js-v2.3.0","opener-v2.2.1","opener-js-v2.2.1","window-state-v2.2.0","window-state-js-v2.2.0","websocket-v2.2.0","websocket-js-v2.2.0","updater-v2.2.0","updater-js-v2.2.0","stronghold-v2.2.0","stronghold-js-v2.2.0","store-v2.2.0","store-js-v2.2.0","sql-v2.2.0","sql-js-v2.2.0","single-instance-v2.2.0","shell-v2.2.0","shell-js-v2.2.0","process-v2.2.0","process-js-v2.2.0","positioner-v2.2.0","positioner-js-v2.2.0","persisted-scope-v2.2.0","os-v2.2.0","os-js-v2.2.0","opener-v2.2.0","opener-js-v2.2.0","notification-v2.2.0","notification-js-v2.2.0","nfc-v2.2.0","nfc-js-v2.2.0","log-v2.2.0","log-js-v2.2.0","localhost-v2.2.0","http-v2.2.0","http-js-v2.2.0","haptics-v2.2.0","haptics-js-v2.2.0","global-shortcut-v2.2.0","global-shortcut-js-v2.2.0","geolocation-v2.2.0","geolocation-js-v2.2.0","fs-v2.2.0","fs-js-v2.2.0","dialog-v2.2.0","dialog-js-v2.2.0","deep-link-v2.2.0","deep-link-js-v2.2.0","clipboard-manager-v2.2.0","clipboard-manager-js-v2.2.0","cli-v2.2.0","cli-js-v2.2.0","biometric-v2.2.0","biometric-js-v2.2.0","barcode-scanner-v2.2.0","barcode-scanner-js-v2.2.0","autostart-v2.2.0","autostart-js-v2.2.0","persisted-scope-v2.1.1","http-v2.0.5","http-js-v2.0.2","fs-v2.1.1","fs-js-v2.0.4","dialog-v2.0.5","dialog-js-v2.0.2","log-v2.0.4","log-js-v2.0.2","upload-v2.2.1","upload-js-v2.2.1","sql-js-v2.0.2","upload-v2.2.0","upload-js-v2.2.0","updater-v2.1.0","sql-v2.0.3","single-instance-v2.0.2","positioner-v2.1.0","positioner-js-v2.1.0","persisted-scope-v2.1.0","opener-v2.0.0","opener-js-v2.0.0","log-plugin-v2.0.3","log-js-v2.0.1","localhost-v2.1.0","http-v2.0.4","fs-v2.1.0","fs-js-v2.0.3","dialog-v2.0.4","deep-link-v2.0.2","deep-link-js-v2.0.1","clipboard-manager-js-v2.0.1","window-state-v2.0.2","upload-v2.1.0","upload-js-v2.1.0","sql-v2.0.2","sql-js-v2.0.1","log-plugin-v2.0.2","fs-js-v2.0.2","clipboard-manager-v2.0.2","persisted-scope-v2.0.3","http-v2.0.3","fs-v2.0.3","dialog-v2.0.3","store-v2.1.0","store-js-v2.1.0","shell-v2.0.2","shell-js-v2.0.1","positioner-v2.0.2","positioner-js-v2.0.1","persisted-scope-v2.0.2","http-v2.0.2","http-js-v2.0.1","fs-v2.0.2","fs-js-v2.0.1","dialog-v2.0.2","dialog-js-v2.0.1","window-state-v2.0.1","websocket-v2.0.1","upload-v2.0.1","updater-v2.0.2","stronghold-v2.0.1","store-v2.0.1","sql-v2.0.1","single-instance-v2.0.1","shell-v2.0.1","process-v2.0.1","positioner-v2.0.1","persisted-scope-v2.0.1","os-v2.0.1","notification-v2.0.1","nfc-v2.0.1","log-plugin-v2.0.1","localhost-v2.0.1","http-v2.0.1","haptics-v2.0.1","global-shortcut-v2.0.1","geolocation-v2.0.1","fs-v2.0.1","dialog-v2.0.1","deep-link-v2.0.1","clipboard-manager-v2.0.1","cli-v2.0.1","biometric-v2.0.1","barcode-scanner-v2.0.1","autostart-v2.0.1","updater-v2.0.1","window-state-v2.0.0","window-state-js-v2.0.0","websocket-v2.0.0","websocket-js-v2.0.0","upload-v2.0.0","upload-js-v2.0.0","updater-v2.0.0","updater-js-v2.0.0","stronghold-v2.0.0","stronghold-js-v2.0.0","store-v2.0.0","store-js-v2.0.0","sql-v2.0.0","sql-js-v2.0.0","single-instance-v2.0.0","shell-v2.0.0","shell-js-v2.0.0","process-v2.0.0","process-js-v2.0.0","positioner-v2.0.0","positioner-js-v2.0.0","persisted-scope-v2.0.0","os-v2.0.0","os-js-v2.0.0","notification-v2.0.0","notification-js-v2.0.0","nfc-v2.0.0","nfc-js-v2.0.0","log-plugin-v2.0.0","log-js-v2.0.0","localhost-v2.0.0","http-v2.0.0","http-js-v2.0.0","haptics-v2.0.0","haptics-js-v2.0.0","global-shortcut-v2.0.0","global-shortcut-js-v2.0.0","geolocation-v2.0.0","geolocation-js-v2.0.0","fs-v2.0.0","fs-js-v2.0.0","dialog-v2.0.0","dialog-js-v2.0.0","deep-link-v2.0.0","deep-link-js-v2.0.0","clipboard-manager-v2.0.0","clipboard-manager-js-v2.0.0","cli-v2.0.0","cli-js-v2.0.0","biometric-v2.0.0","biometric-js-v2.0.0","barcode-scanner-v2.0.0","barcode-scanner-js-v2.0.0","autostart-v2.0.0","autostart-js-v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-95625.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"}]}