AIKIDO-2026-115347
tauri-plugin-updater is vulnerable to Improper Access Control
68
Medium Risk
This Affects:
tauri-plugin-updaterTL;DR
The updater plugin's check IPC command accepts an allowDowngrades boolean from frontend JavaScript, and the default permission set grants the WebView access to invoke this command. Setting allowDowngrades to true switches the version comparator from requiring a newer version to only requiring a different version, disabling the updater's only anti-rollback check. Any Cross-Site Scripting in the frontend can invoke this command and replay an old, validly signed build to force the application back to a version that was already patched. The fix moves the allowDowngrades option into application level Rust configuration so WebView code can no longer set it, and it now defaults to false.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and untrusted frontend code, for example through Cross-Site Scripting, can reach the updater's check command.
Background info
tauri-plugin-updater is vulnerable to Improper Access Control in versions 2.8.0 - 2.11.0.
How to fix this
Upgrade the tauri-plugin-updater library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.