Product
Rclone versions 1.55.0 through 1.75.1 contain a signature verification bypass in the selfupdate function that allows attackers to install malicious executables by prepending unsigned checksums to the verification block.