Sparkle Project Sparkle
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Sparkle Project Sparkle.
By the Year
In 2026 there have been 0 vulnerabilities in Sparkle Project Sparkle. Last year, in 2025 Sparkle had 3 security vulnerabilities published. Right now, Sparkle is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 3 | 6.80 |
It may take a day or so for new Sparkle vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Sparkle Project Sparkle Security Vulnerabilities
Local Privilege Escalation in Sparkle Autoupdate (before 2.7.2)
CVE-2025-10016
- September 16, 2025
The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privileges. It is worth noting that it is possible to spawn Autopudate manually via Installer XPC service. However this requires the victim to enter credentials upon system authorization dialog creation that can be modified by the attacker. This issue was fixed in version 2.7.2
AuthZ
Sparkle Framework XPC Downloader Privilege Escalation before 2.7.2
CVE-2025-10015
- September 16, 2025
The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2
AuthZ
Sparkle <=2.6.4 Bypass EDSA Signing for Update Replacement
CVE-2025-0509
6.8 - Medium
- February 04, 2025
A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkles (Ed)DSA signing checks.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Sparkle Project Sparkle or by Sparkle Project? Click the Watch button to subscribe.
