github.com/sparkle-project/Sparkle vulnerabilities (SwiftURL)

3 vulnerabilities.

• github.com/sparkle-project/Sparkle SwiftURL Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection CVE-2026-47122 4.2 MediumMay 29, 2026
• github.com/sparkle-project/Sparkle SwiftURL Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CVE-2026-47121 Fix available 6.1 MediumMay 29, 2026
• github.com/sparkle-project/Sparkle SwiftURL Signing Checks Bypass CVE-2025-0509 Fix available 7.3 HighFebruary 4, 2025