The tauri-plugin-updater’s IPC ‘check’ command accepts a boolean allowDowngrades parameter from frontend JavaScript. When set to true, the update logic changes from enforcing that a new version be newer to only checking that it is different, thereby disabling the updater’s anti-rollback protection. As the default permission set grants allow‑check to the webview, any XSS vulnerability in the front‑end can trigger this command and force a downgrade to an older, potentially vulnerable release. This allows an attacker to replace a trusted build with malware or an older version containing known weaknesses, effectively compromising the application.

Any Tauri application that uses the tauri-plugin-updater before v2.12.0 is vulnerable. The flaw exists only when the frontend can call the updater’s IPC ‘check’ command, which is granted by default to the webview. The upstream fix removes the allowDowngrades parameter from the command and reads it from the plugin configuration, where front‑end code cannot reach it, and it defaults to false. Legacy apps that have not upgraded to 2.12.0 or that still rely on a custom version comparator remain affected.

The CVSS score of 6.8 indicates a moderate severity vulnerability, but the lack of an EPSS score means the likelihood of exploitation is not quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a frontend XSS or an ability to inject JavaScript into the webview, after which the attacker can invoke the check command with allowDowngrades set to true. Once a downgrade is triggered, the attacker can install a malicious or vulnerable build, potentially leading to code execution. Therefore, while the standalone impact is moderate, the potential downstream compromise is significant, warranting immediate attention.