Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-47122Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Medium 4.2

In plain English

A medium-severity missing authentication in Sparkle from sparkle-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.1%top 98.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.

Affected products (as reported)

Vendor	Product	Versions
sparkle-project	Sparkle	<= 2.9.1

Weakness: CWE-306, CWE-441 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

References

https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-g3hp-f6mg-559v x_refsource_CONFIRM