Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. Details Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After...

PT-2026-45020

Name of the Vulnerable Software and Affected Versions Sparkle versions 2.x through 2.9.1 Description In the Autoupdate/AppInstaller.m file, the shouldAcceptNewConnection: function only enforces SUCodeSigningVerifier validateConnection: before the first stage of installation completes. Once...