CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.

• CWE-22
• CWE-59

• https://github.com/sparkle-project/Sparkle/commit/fe7b718d0736f3e139e374e26fbca96f29e13bf0Patch
• https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrhVendor Advisory
• https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-hg88-v3cw-3qrhVendor Advisory

Published

Jul 21, 2026

Last Modified

Aug 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47114IINA before 1.4.3 contains a user-assisted command execution…8.8
• CVE-2026-47117OpenMed before 1.5.2 contains a remote code execution vulner…9.8
• CVE-2026-47118Agent Zero before version 1.15 contains a path traversal vul…7.1
• CVE-2026-47119Agent Zero before version 1.15 contains a stored cross-site …6.1
• CVE-2026-4712Information disclosure in the Widget: Cocoa component. This …7.5
• CVE-2026-47120Nezha Monitoring is a self-hostable, lightweight, servers an…7.1
• CVE-2026-47122Sparkle is a software update framework for macOS. In version…4.2
• CVE-2026-47123FreeScout is a free help desk and shared inbox built with PH…7.5
• CVE-2026-47124Nezha Monitoring is a self-hostable, lightweight, servers an…6.5
• CVE-2026-47125Arcane is an interface for managing Docker containers, image…8.8
• CVE-2026-47127Ghostfolio is an open source wealth management software. Pri…6.5
• CVE-2026-47128nono is software that allows users to run AI agents in a zer…6.1