swifturl github.com/sparkle-project/Sparkle vulnerabilities

Latest swifturl github.com/sparkle-project/Sparkle CVEs

Newest publication first

1. CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

   Published 2026-07-21

   Medium·CVSS 4.2 EPSS 0.11%

   Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After _performedStage1Installation = YES, new connecti...

2. CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

   Published 2026-07-21

   Medium·CVSS 6.1 EPSS 0.34%

   Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper i...

3. CVE-2025-0509 Signing Checks Bypass

   Published 2025-02-04

   Medium·CVSS 6.8 EPSS 0.90%

   A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.