CVE-2026-95625

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95625
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95625.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-95625
Aliases
  • GHSA-j38x-g3m3-95fr
Downstream
Published
2026-09-23T08:51:53Z
Modified
2026-09-24T03:47:09Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade
Details

The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.

Database specific 
{
    "cna_assigner":  "JFROG",
    "cwe_ids":  [
        "CWE-354"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95625.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.12.0"
                },
                {
                    "last_affected":  "*"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/tauri-apps/plugins-workspace

Affected ranges

Type
GIT
Repo
git://github.com/tauri-apps/plugins-workspace
Events
Introduced
e8069af80401cfc1e90297b786bef05a929ed9a6
Fixed
5baf71a47292d8490f0ba3d53f15224e55c48327
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "2.12.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

autostart-js-v2.*
autostart-js-v2.0.0
autostart-js-v2.2.0
autostart-js-v2.3.0
autostart-js-v2.4.0
autostart-js-v2.5.0
autostart-js-v2.5.1
autostart-v2.*
autostart-v2.0.0
autostart-v2.0.1
autostart-v2.2.0
autostart-v2.3.0
autostart-v2.4.0
autostart-v2.5.0
autostart-v2.5.1
barcode-scanner-js-v2.*
barcode-scanner-js-v2.0.0
barcode-scanner-js-v2.2.0
barcode-scanner-js-v2.2.1
barcode-scanner-js-v2.3.0
barcode-scanner-js-v2.4.0
barcode-scanner-js-v2.4.1
barcode-scanner-js-v2.4.2
barcode-scanner-js-v2.4.3
barcode-scanner-js-v2.4.4
barcode-scanner-js-v2.4.5
barcode-scanner-js-v2.4.6
barcode-scanner-v2.*
barcode-scanner-v2.0.0
barcode-scanner-v2.0.1
barcode-scanner-v2.2.0
barcode-scanner-v2.2.1
barcode-scanner-v2.3.0
barcode-scanner-v2.4.0
barcode-scanner-v2.4.1
barcode-scanner-v2.4.2
barcode-scanner-v2.4.3
barcode-scanner-v2.4.4
barcode-scanner-v2.4.5
barcode-scanner-v2.4.6
biometric-js-v2.*
biometric-js-v2.0.0
biometric-js-v2.2.0
biometric-js-v2.2.1
biometric-js-v2.2.2
biometric-js-v2.3.0
biometric-js-v2.3.1
biometric-js-v2.3.2
biometric-js-v2.3.3
biometric-v2.*
biometric-v2.0.0
biometric-v2.0.1
biometric-v2.2.0
biometric-v2.2.1
biometric-v2.2.2
biometric-v2.3.0
biometric-v2.3.1
biometric-v2.3.2
biometric-v2.3.3
cli-js-v2.*
cli-js-v2.0.0
cli-js-v2.2.0
cli-js-v2.2.1
cli-js-v2.3.0
cli-js-v2.4.0
cli-js-v2.4.1
cli-v2.*
cli-v2.0.0
cli-v2.0.1
cli-v2.2.0
cli-v2.2.1
cli-v2.3.0
cli-v2.4.0
cli-v2.4.1
clipboard-manager-js-v2.*
clipboard-manager-js-v2.0.0
clipboard-manager-js-v2.0.1
clipboard-manager-js-v2.2.0
clipboard-manager-js-v2.2.1
clipboard-manager-js-v2.2.2
clipboard-manager-js-v2.2.3
clipboard-manager-js-v2.3.0
clipboard-manager-js-v2.3.1
clipboard-manager-js-v2.3.2
clipboard-manager-js-v2.3.3
clipboard-manager-v2.*
clipboard-manager-v2.0.0
clipboard-manager-v2.0.1
clipboard-manager-v2.0.2
clipboard-manager-v2.2.0
clipboard-manager-v2.2.1
clipboard-manager-v2.2.2
clipboard-manager-v2.2.3
clipboard-manager-v2.3.0
clipboard-manager-v2.3.1
clipboard-manager-v2.3.2
clipboard-manager-v2.3.3
deep-link-js-v2.*
deep-link-js-v2.0.0
deep-link-js-v2.0.1
deep-link-js-v2.2.0
deep-link-js-v2.2.1
deep-link-js-v2.3.0
deep-link-js-v2.4.0
deep-link-js-v2.4.1
deep-link-js-v2.4.10
deep-link-js-v2.4.2
deep-link-js-v2.4.3
deep-link-js-v2.4.4
deep-link-js-v2.4.5
deep-link-js-v2.4.6
deep-link-js-v2.4.7
deep-link-js-v2.4.8
deep-link-js-v2.4.9
deep-link-v2.*
deep-link-v2.0.0
deep-link-v2.0.1
deep-link-v2.0.2
deep-link-v2.2.0
deep-link-v2.2.1
deep-link-v2.3.0
deep-link-v2.4.0
deep-link-v2.4.1
deep-link-v2.4.10
deep-link-v2.4.2
deep-link-v2.4.3
deep-link-v2.4.4
deep-link-v2.4.5
deep-link-v2.4.6
deep-link-v2.4.7
deep-link-v2.4.8
deep-link-v2.4.9
dialog-js-v2.*
dialog-js-v2.0.0
dialog-js-v2.0.1
dialog-js-v2.0.2
dialog-js-v2.2.0
dialog-js-v2.2.1
dialog-js-v2.2.2
dialog-js-v2.3.0
dialog-js-v2.3.1
dialog-js-v2.3.2
dialog-js-v2.3.3
dialog-js-v2.4.0
dialog-js-v2.4.1
dialog-js-v2.4.2
dialog-js-v2.5.0
dialog-js-v2.6.0
dialog-js-v2.7.0
dialog-js-v2.7.1
dialog-js-v2.7.2
dialog-js-v2.7.3
dialog-v2.*
dialog-v2.0.0
dialog-v2.0.1
dialog-v2.0.2
dialog-v2.0.3
dialog-v2.0.4
dialog-v2.0.5
dialog-v2.2.0
dialog-v2.2.1
dialog-v2.2.2
dialog-v2.3.0
dialog-v2.3.1
dialog-v2.3.2
dialog-v2.3.3
dialog-v2.4.0
dialog-v2.4.1
dialog-v2.4.2
dialog-v2.5.0
dialog-v2.6.0
dialog-v2.7.0
dialog-v2.7.1
dialog-v2.7.2
dialog-v2.7.3
fs-js-v2.*
fs-js-v2.0.0
fs-js-v2.0.1
fs-js-v2.0.2
fs-js-v2.0.3
fs-js-v2.0.4
fs-js-v2.2.0
fs-js-v2.2.1
fs-js-v2.3.0
fs-js-v2.4.0
fs-js-v2.4.1
fs-js-v2.4.2
fs-js-v2.4.3
fs-js-v2.4.4
fs-js-v2.4.5
fs-js-v2.5.0
fs-js-v2.5.1
fs-js-v2.5.2
fs-v2.*
fs-v2.0.0
fs-v2.0.1
fs-v2.0.2
fs-v2.0.3
fs-v2.1.0
fs-v2.1.1
fs-v2.2.0
fs-v2.2.1
fs-v2.3.0
fs-v2.4.0
fs-v2.4.1
fs-v2.4.2
fs-v2.4.3
fs-v2.4.4
fs-v2.4.5
fs-v2.5.0
fs-v2.5.1
fs-v2.5.2
geolocation-js-v2.*
geolocation-js-v2.0.0
geolocation-js-v2.2.0
geolocation-js-v2.2.1
geolocation-js-v2.2.2
geolocation-js-v2.2.3
geolocation-js-v2.2.4
geolocation-js-v2.2.5
geolocation-js-v2.3.0
geolocation-js-v2.3.1
geolocation-js-v2.3.2
geolocation-js-v2.3.3
geolocation-v2.*
geolocation-v2.0.0
geolocation-v2.0.1
geolocation-v2.2.0
geolocation-v2.2.1
geolocation-v2.2.2
geolocation-v2.2.3
geolocation-v2.2.4
geolocation-v2.2.5
geolocation-v2.3.0
geolocation-v2.3.1
geolocation-v2.3.2
geolocation-v2.3.3
global-shortcut-js-v2.*
global-shortcut-js-v2.0.0
global-shortcut-js-v2.2.0
global-shortcut-js-v2.2.1
global-shortcut-js-v2.3.0
global-shortcut-js-v2.3.1
global-shortcut-js-v2.3.2
global-shortcut-v2.*
global-shortcut-v2.0.0
global-shortcut-v2.0.1
global-shortcut-v2.2.0
global-shortcut-v2.2.1
global-shortcut-v2.3.0
global-shortcut-v2.3.1
global-shortcut-v2.3.2
haptics-js-v2.*
haptics-js-v2.0.0
haptics-js-v2.2.0
haptics-js-v2.2.1
haptics-js-v2.2.2
haptics-js-v2.2.3
haptics-js-v2.2.4
haptics-js-v2.2.5
haptics-js-v2.3.0
haptics-js-v2.3.1
haptics-js-v2.3.2
haptics-js-v2.3.3
haptics-v2.*
haptics-v2.0.0
haptics-v2.0.1
haptics-v2.2.0
haptics-v2.2.1
haptics-v2.2.2
haptics-v2.2.3
haptics-v2.2.4
haptics-v2.2.5
haptics-v2.3.0
haptics-v2.3.1
haptics-v2.3.2
haptics-v2.3.3
http-js-v2.*
http-js-v2.0.0
http-js-v2.0.1
http-js-v2.0.2
http-js-v2.2.0
http-js-v2.3.0
http-js-v2.4.0
http-js-v2.4.1
http-js-v2.4.2
http-js-v2.4.3
http-js-v2.4.4
http-js-v2.5.0
http-js-v2.5.1
http-js-v2.5.2
http-js-v2.5.3
http-js-v2.5.4
http-js-v2.5.5
http-js-v2.5.6
http-js-v2.5.7
http-js-v2.5.8
http-js-v2.5.9
http-js-v2.6.0
http-js-v2.6.1
http-v2.*
http-v2.0.0
http-v2.0.1
http-v2.0.2
http-v2.0.3
http-v2.0.4
http-v2.0.5
http-v2.2.0
http-v2.3.0
http-v2.4.0
http-v2.4.1
http-v2.4.2
http-v2.4.3
http-v2.4.4
http-v2.5.0
http-v2.5.1
http-v2.5.2
http-v2.5.3
http-v2.5.4
http-v2.5.5
http-v2.5.6
http-v2.5.7
http-v2.5.8
http-v2.5.9
http-v2.6.0
http-v2.6.1
localhost-v2.*
localhost-v2.0.0
localhost-v2.0.1
localhost-v2.1.0
localhost-v2.2.0
localhost-v2.2.1
localhost-v2.3.0
localhost-v2.3.1
localhost-v2.3.2
log-js-v2.*
log-js-v2.0.0
log-js-v2.0.1
log-js-v2.0.2
log-js-v2.2.0
log-js-v2.2.1
log-js-v2.2.2
log-js-v2.2.3
log-js-v2.3.0
log-js-v2.3.1
log-js-v2.4.0
log-js-v2.5.0
log-js-v2.5.1
log-js-v2.6.0
log-js-v2.7.0
log-js-v2.7.1
log-js-v2.8.0
log-js-v2.9.0
log-js-v2.9.1
log-plugin-v2.*
log-plugin-v2.0.0
log-plugin-v2.0.1
log-plugin-v2.0.2
log-plugin-v2.0.3
log-v2.*
log-v2.0.4
log-v2.2.0
log-v2.2.1
log-v2.2.2
log-v2.2.3
log-v2.3.0
log-v2.3.1
log-v2.4.0
log-v2.5.0
log-v2.5.1
log-v2.6.0
log-v2.7.0
log-v2.7.1
log-v2.8.0
log-v2.9.0
log-v2.9.1
nfc-js-v2.*
nfc-js-v2.0.0
nfc-js-v2.2.0
nfc-js-v2.2.1
nfc-js-v2.3.0
nfc-js-v2.3.1
nfc-js-v2.3.2
nfc-js-v2.3.3
nfc-js-v2.3.4
nfc-js-v2.3.5
nfc-js-v2.3.6
nfc-v2.*
nfc-v2.0.0
nfc-v2.0.1
nfc-v2.2.0
nfc-v2.2.1
nfc-v2.3.0
nfc-v2.3.1
nfc-v2.3.2
nfc-v2.3.3
nfc-v2.3.4
nfc-v2.3.5
nfc-v2.3.6
notification-js-v2.*
notification-js-v2.0.0
notification-js-v2.2.0
notification-js-v2.2.1
notification-js-v2.2.2
notification-js-v2.2.3
notification-js-v2.3.0
notification-js-v2.3.1
notification-js-v2.3.2
notification-js-v2.3.3
notification-js-v2.4.0
notification-v2.*
notification-v2.0.0
notification-v2.0.1
notification-v2.2.0
notification-v2.2.1
notification-v2.2.2
notification-v2.2.3
notification-v2.3.0
notification-v2.3.1
notification-v2.3.2
notification-v2.3.3
notification-v2.4.0
opener-js-v2.*
opener-js-v2.0.0
opener-js-v2.2.0
opener-js-v2.2.1
opener-js-v2.2.2
opener-js-v2.2.3
opener-js-v2.2.4
opener-js-v2.2.5
opener-js-v2.2.6
opener-js-v2.2.7
opener-js-v2.3.0
opener-js-v2.3.1
opener-js-v2.4.0
opener-js-v2.5.0
opener-js-v2.5.1
opener-js-v2.5.2
opener-js-v2.5.3
opener-js-v2.5.4
opener-js-v2.5.5
opener-v2.*
opener-v2.0.0
opener-v2.2.0
opener-v2.2.1
opener-v2.2.2
opener-v2.2.3
opener-v2.2.4
opener-v2.2.5
opener-v2.2.6
opener-v2.2.7
opener-v2.3.0
opener-v2.3.1
opener-v2.4.0
opener-v2.5.0
opener-v2.5.1
opener-v2.5.2
opener-v2.5.3
opener-v2.5.4
opener-v2.5.5
os-js-v2.*
os-js-v2.0.0
os-js-v2.2.0
os-js-v2.2.1
os-js-v2.2.2
os-js-v2.3.0
os-js-v2.3.1
os-js-v2.3.2
os-v2.*
os-v2.0.0
os-v2.0.1
os-v2.2.0
os-v2.2.1
os-v2.2.2
os-v2.3.0
os-v2.3.1
os-v2.3.2
persisted-scope-v2.*
persisted-scope-v2.0.0
persisted-scope-v2.0.1
persisted-scope-v2.0.2
persisted-scope-v2.0.3
persisted-scope-v2.1.0
persisted-scope-v2.1.1
persisted-scope-v2.2.0
persisted-scope-v2.2.1
persisted-scope-v2.2.2
persisted-scope-v2.3.0
persisted-scope-v2.3.1
persisted-scope-v2.3.2
persisted-scope-v2.3.3
persisted-scope-v2.3.4
persisted-scope-v2.3.5
persisted-scope-v2.3.6
persisted-scope-v2.3.7
persisted-scope-v2.3.8
positioner-js-v2.*
positioner-js-v2.0.0
positioner-js-v2.0.1
positioner-js-v2.1.0
positioner-js-v2.2.0
positioner-js-v2.2.1
positioner-js-v2.3.0
positioner-js-v2.3.1
positioner-js-v2.3.2
positioner-js-v2.3.3
positioner-js-v2.3.4
positioner-v2.*
positioner-v2.0.0
positioner-v2.0.1
positioner-v2.0.2
positioner-v2.1.0
positioner-v2.2.0
positioner-v2.2.1
positioner-v2.3.0
positioner-v2.3.1
positioner-v2.3.2
positioner-v2.3.3
positioner-v2.3.4
process-js-v2.*
process-js-v2.0.0
process-js-v2.2.0
process-js-v2.2.1
process-js-v2.2.2
process-js-v2.3.0
process-js-v2.3.1
process-v2.*
process-v2.0.0
process-v2.0.1
process-v2.2.0
process-v2.2.1
process-v2.2.2
process-v2.3.0
process-v2.3.1
shell-js-v2.*
shell-js-v2.0.0
shell-js-v2.0.1
shell-js-v2.2.0
shell-js-v2.2.1
shell-js-v2.2.2
shell-js-v2.3.0
shell-js-v2.3.1
shell-js-v2.3.2
shell-js-v2.3.3
shell-js-v2.3.4
shell-js-v2.3.5
shell-js-v2.3.6
shell-v2.*
shell-v2.0.0
shell-v2.0.1
shell-v2.0.2
shell-v2.2.0
shell-v2.2.1
shell-v2.2.2
shell-v2.3.0
shell-v2.3.1
shell-v2.3.2
shell-v2.3.3
shell-v2.3.4
shell-v2.3.5
shell-v2.3.6
single-instance-v2.*
single-instance-v2.0.0
single-instance-v2.0.1
single-instance-v2.0.2
single-instance-v2.2.0
single-instance-v2.2.1
single-instance-v2.2.2
single-instance-v2.2.3
single-instance-v2.2.4
single-instance-v2.3.0
single-instance-v2.3.1
single-instance-v2.3.2
single-instance-v2.3.3
single-instance-v2.3.4
single-instance-v2.3.5
single-instance-v2.3.6
single-instance-v2.3.7
single-instance-v2.4.0
single-instance-v2.4.1
single-instance-v2.4.2
single-instance-v2.4.3
single-instance-v2.4.4
sql-js-v2.*
sql-js-v2.0.0
sql-js-v2.0.1
sql-js-v2.0.2
sql-js-v2.2.0
sql-js-v2.2.1
sql-js-v2.3.0
sql-js-v2.3.1
sql-js-v2.3.2
sql-js-v2.4.0
sql-js-v2.4.1
sql-v2.*
sql-v2.0.0
sql-v2.0.1
sql-v2.0.2
sql-v2.0.3
sql-v2.2.0
sql-v2.2.1
sql-v2.3.0
sql-v2.3.1
sql-v2.3.2
sql-v2.4.0
sql-v2.4.1
store-js-v2.*
store-js-v2.0.0
store-js-v2.1.0
store-js-v2.2.0
store-js-v2.2.1
store-js-v2.3.0
store-js-v2.4.0
store-js-v2.4.1
store-js-v2.4.2
store-js-v2.4.3
store-js-v2.4.4
store-js-v2.4.5
store-v2.*
store-v2.0.0
store-v2.0.1
store-v2.1.0
store-v2.2.0
store-v2.2.1
store-v2.3.0
store-v2.4.0
store-v2.4.1
store-v2.4.2
store-v2.4.3
store-v2.4.4
store-v2.4.5
stronghold-js-v2.*
stronghold-js-v2.0.0
stronghold-js-v2.2.0
stronghold-js-v2.2.1
stronghold-js-v2.3.0
stronghold-js-v2.3.1
stronghold-js-v2.3.2
stronghold-v2.*
stronghold-v2.0.0
stronghold-v2.0.1
stronghold-v2.2.0
stronghold-v2.2.1
stronghold-v2.3.0
stronghold-v2.3.1
stronghold-v2.3.2
updater-js-v2.*
updater-js-v2.0.0
updater-js-v2.10.0
updater-js-v2.10.1
updater-js-v2.11.0
updater-js-v2.2.0
updater-js-v2.3.0
updater-js-v2.3.1
updater-js-v2.4.0
updater-js-v2.5.0
updater-js-v2.5.1
updater-js-v2.6.0
updater-js-v2.6.1
updater-js-v2.7.0
updater-js-v2.7.1
updater-js-v2.8.0
updater-js-v2.8.1
updater-js-v2.9.0
updater-v2.*
updater-v2.0.0
updater-v2.0.1
updater-v2.0.2
updater-v2.1.0
updater-v2.10.0
updater-v2.10.1
updater-v2.11.0
updater-v2.2.0
updater-v2.3.0
updater-v2.3.1
updater-v2.4.0
updater-v2.5.0
updater-v2.5.1
updater-v2.6.0
updater-v2.6.1
updater-v2.7.0
updater-v2.7.1
updater-v2.8.0
updater-v2.8.1
updater-v2.9.0
upload-js-v2.*
upload-js-v2.0.0
upload-js-v2.1.0
upload-js-v2.2.0
upload-js-v2.2.1
upload-js-v2.2.2
upload-js-v2.3.0
upload-js-v2.3.1
upload-js-v2.3.2
upload-js-v2.4.0
upload-js-v2.4.1
upload-v2.*
upload-v2.0.0
upload-v2.0.1
upload-v2.1.0
upload-v2.2.0
upload-v2.2.1
upload-v2.2.2
upload-v2.3.0
upload-v2.3.1
upload-v2.3.2
upload-v2.4.0
upload-v2.4.1
websocket-js-v2.*
websocket-js-v2.0.0
websocket-js-v2.2.0
websocket-js-v2.2.1
websocket-js-v2.3.0
websocket-js-v2.3.1
websocket-js-v2.4.0
websocket-js-v2.4.1
websocket-js-v2.4.2
websocket-js-v2.4.3
websocket-v2.*
websocket-v2.0.0
websocket-v2.0.1
websocket-v2.2.0
websocket-v2.2.1
websocket-v2.3.0
websocket-v2.3.1
websocket-v2.4.0
websocket-v2.4.1
websocket-v2.4.2
websocket-v2.4.3
window-state-js-v2.*
window-state-js-v2.0.0
window-state-js-v2.2.0
window-state-js-v2.2.1
window-state-js-v2.2.2
window-state-js-v2.2.3
window-state-js-v2.3.0
window-state-js-v2.4.0
window-state-js-v2.4.1
window-state-v2.*
window-state-v2.0.0
window-state-v2.0.1
window-state-v2.0.2
window-state-v2.2.0
window-state-v2.2.1
window-state-v2.2.2
window-state-v2.2.3
window-state-v2.3.0
window-state-v2.4.0
window-state-v2.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95625.json"