Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the shouldAcceptNewConnection process. An attacker can inject spoofed appcast item data by establishing unauthorized local connections to the registered Mach service after stage 1...

CVE-2026-47122

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47122

Sparkle CVE-2026-47122 affects Sparkle 2.x up to 2.9.1. After stage 1 installation, the AppInstaller’s Mach service (-spki) accepts connections from any local process without team-ID or code-signing checks, enabling a local attacker to inject a spoofed SPUSentUpdateAppcastItemData payload and cau...

CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

EUVD-2026-46275

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121

Sparkle vulnerability CVE-2026-47121 (affecting macOS AutoUpdate) arises from a defense-in-depth gap in delta application. An archive item can create a symlink in the destination tree and a subsequent file write may traverse the symlink path, allowing writes outside the intended destination when ...

EUVD-2026-46259

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121: Improper Limitation of a Pathname to a Restricted Directory

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47122: Missing Authentication for Critical Function

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

EUVD-2023-60590

Missing Authorization vulnerability in Sparkle WP MetroStore metrostore allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MetroStore: from n/a through 1.3.2...

WordPress Theme: sparklestore: CVE-2023-32959: Missing Authorization

Missing Authorization vulnerability in Sparkle WP MetroStore metrostore allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MetroStore: from n/a through 1.3.2...

GHSA-G3HP-F6MG-559V Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. Details Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After...

Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. Details Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After...