CVE-2026-47122

MEDIUM 4.2CVE-2026-47122 · Published 21/07/2026 · updated 24/10/2026

In short

CVE-2026-47122 is a MEDIUM (CVSS 4.2) vulnerability affecting sparkle (sparkle-project).
Chance of exploitation in the next 30 days (EPSS): 0.10%, higher than 1.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
sparkle sparkle-project	`≤ 2.9.1`	No fix yet

Description

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.

References

sparkle-project/Sparkle security advisory · Vendor Advisory

More vulnerabilities in sparkle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free