Sparkle, a macOS software update framework, contains a flaw in versions up to 2.9.1 where the XPC listener that serves the Mach service <bundleId>-spki accepts new connections without validating the caller’s code signature once stage 1 of the installation is completed. This allows any local process to connect to the service and supply forged appcast item data. The injected data can cause the application to install unauthorized or malicious update content, compromising the software’s integrity. The weakness arises from missing authentication checks (CWE‑306) and improper handling of sensitive data (CWE‑441). No patched versions are currently available.

Sparkle 2.9.1 and earlier are vulnerable. The issue exists in all deployments of the Sparkle update framework before version 2.9.1 on macOS, regardless of the bundle identifier used by the application.

The CVSS score of 4.2 indicates a low severity level, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability requires a local attacker who can run a process on the system after the application has installed, so it is not remotely exploitable. Because the security issue is not listed in CISA’s KEV catalog, there are no known widespread active attacks. Nonetheless, any local adversary familiar with the app’s Mach service could exploit the flaw to inject rogue update data.