Download of Code Without Integrity Check Vulnerability (CVE-2026-104657)

Updated on Nov 6, 2026

Description

October 2026 - CVE-2026-104657

Progress Telerik Fiddler Download & Setup Skill copies downloaded before October 5, 2026. The skill is not versioned.

The affected skill reads a version from a remote release manifest and constructs a download URL, but does not verify the downloaded artifact against the manifest's SHA-512 value or a platform signature before execution. An attacker who compromises or influences a release component could deliver attacker-controlled code that runs when a user invokes the skill.

On macOS, the affected skill stages the package at the predictable /tmp/FiddlerEverywhere.pkg path and installs it with administrator privileges. A malicious package could execute with root privileges after the user approves the prompt. A local process may also replace the staged package while the skill waits for approval. On Windows and Linux, executing an unverified artifact could compromise the user's account or, if elevation is granted on Windows, the system.

Issue

CWE-494: Download of Code Without Integrity Check
CWE-377: Insecure Temporary File

Solution

Progress has addressed the issue in the currently published Fiddler Download & Setup Skill. The skill verifies downloaded artifacts before execution and uses secure, uniquely named temporary locations. The macOS flow uses a verified DMG and does not perform an administrator-privileged package installation.

Because the skill is not versioned and does not have an automatic update mechanism, remove any affected copy and obtain the latest copy from the official fiddler-agent-tools repository. Follow the agent-skill installation instructions to install the replacement skill in your coding tool. Updating the Fiddler Everywhere application alone does not replace the skill.

Mitigation

Do not run an existing copy of the affected skill. As a temporary workaround, install Fiddler manually from the official distribution source, verify the downloaded artifact's publisher signature and available checksum, and on macOS use a per-user DMG installation without administrator privileges. Downloading from the official site alone is not a complete mitigation unless the artifact is independently verified.

Notes

Progress Software thanks Abhishek Nandkumar Bhaskar (Abhi-Hackz) and komyeonghane320f9 for reporting this issue.
If you have questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.

External References

CVE-2026-104657 (High)

CVSS: 8.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

In the Progress Telerik Fiddler Download & Setup Skill, missing integrity verification for downloaded installers could allow attacker-controlled code execution. On macOS, the affected flow could execute a malicious package with root privileges after user approval.