CVE-2026-47122: Sparkle Package Vulnerability Allows Spoofed Appcast Item Data Injection
Summary
CVE-2026-47122: AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. Affects github.com/sparkle-project/Sparkle versions < 2.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sparkle is an open-source framework designed to facilitate the updating of applications on macOS. It provides a seamless way for developers to implement automatic updates for their applications, ensuring users always have the latest features and security patches. However, a vulnerability has been identified in the AppInstaller component of Sparkle, specifically in the handling of XPC connections, which can be exploited to inject malicious update information.
Vulnerability Detail
The vulnerability arises from the AppInstaller's post-stage-1 XPC listener, which accepts unvalidated connections after the first stage of installation is complete. This allows an attacker to connect to the Mach service without proper code-signing verification and send a spoofed SPUSentUpdateAppcastItemData payload. The attacker can craft a malicious SUAppcastItem, which can mislead users by displaying false installation metadata such as arbitrary names, versions, and critical flags. Although the integrity of the installed code remains intact, the potential for UI spoofing poses a significant risk to user trust and application security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement additional checks to validate connections before accepting them, ensuring that only trusted processes can communicate with the AppInstaller. This can be done by modifying the shouldAcceptNewConnection method to include stricter validation criteria.
Conclusion
The CVE-2026-47122 vulnerability in the Sparkle framework poses a risk of spoofed appcast item data injection due to inadequate validation of XPC connections. Users are encouraged to update to the latest version to secure their applications and maintain user trust. For those unable to update immediately, implementing stricter connection validation can serve as a temporary measure.
See every vulnerability recorded for github.com/sparkle-project/Sparkle →
FAQ
CVE-2026-47122 is a vulnerability in the Sparkle framework that allows attackers to inject spoofed appcast item data due to unvalidated connections in the AppInstaller component.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in your software without requiring any installation.
The main impact is UI spoofing, where users may see misleading installation metadata, potentially undermining trust in the application, although the actual code integrity remains unaffected.
Yes, a patch is available in version 2.9.2 of the Sparkle framework. It is recommended to update to this version or later to mitigate the vulnerability.
If immediate updating is not possible, implement additional connection validation checks in your application as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/sparkle-project/Sparkle.
