CVE-2026-47122: Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

May 29, 2026

AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection.

References

github.com/advisories/GHSA-g3hp-f6mg-559v
github.com/sparkle-project/Sparkle/security/advisories/GHSA-g3hp-f6mg-559v
nvd.nist.gov/vuln/detail/CVE-2026-47122

Detect and mitigate CVE-2026-47122 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →