sparkle-project/sparkle Security Advisories | GitStock

medium2026-05-29

Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

GHSA-g3hp-f6mg-559v · CVE-2026-47122

medium2026-05-29

Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

GHSA-hg88-v3cw-3qrh · CVE-2026-47121

high2025-02-04

Sparkle Signing Checks Bypass

GHSA-wc9m-r3v6-9p5h · CVE-2025-0509