CVE-2026-95624: Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tauri-plugin-updaterto a version that resolves this vulnerability.Fixed in 2.12.0 - Configuration
Configure allowDowngrades in the plugin configuration, where frontend code cannot reach it, and keep it disabled; it is no longer accepted as a parameter to the check command.
tauri-plugin-updater allowDowngrades = false
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Tauri applications using the updater plugin are exposed when their webview can use the default permission set, which grants the allow-check permission. Exploitation also requires an XSS condition in the application's frontend.
What does an attacker need to exploit the downgrade behavior?
An attacker needs to execute JavaScript in the app frontend through XSS and invoke the updater plugin's check IPC command with allowDowngrades set to true. This changes the update requirement from a newer version to any different version.
Is the default configuration affected?
Yes. The description states that the default permission set grants allow-check to the webview, allowing frontend JavaScript to invoke the affected check command.
What is the practical impact of successful exploitation?
Successful exploitation bypasses the updater's anti-rollback protection and can enable installation of an older version. The described downgrade attack is combined with another bug and does not require faking a higher version number.