Read the docs
TI-2026-39495 Aliases CVE-2026-54672GHSA-7g7r-gx96-252g

electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

Priority LOW 35CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-427.

Summary

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed electron-builder (electron-userland): 26.15.0app-builder-lib (electron-userland): 26.15.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electronelectron-builderbefore 26.15.026.15.0Patch availableCNA
electronapp-builder-libbefore 26.15.026.15.0Patch availableCNA
—app-builder-lib (npm)before 26.15.026.15.0Patch availableGHSA-7g7r-gx96-252g
  • electron-builder Vendorelectron Affected before 26.15.0 Fixed in 26.15.0 Patch available CNA
  • app-builder-lib Vendorelectron Affected before 26.15.0 Fixed in 26.15.0 Patch available CNA
  • app-builder-lib (npm) Vendor— Affected before 26.15.0 Fixed in 26.15.0 Patch available GHSA-7g7r-gx96-252g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:electron:electron-builder:*:*:*:*:*:node.js:*:*before 26.15.0Vulnerableelectron
  • cpe:2.3:a:electron:electron-builder:*:*:*:*:*:node.js:*:* Versions before 26.15.0 Vulnerable ·electron

Remediation

  • Fix · CNA electron-builder (electron-userland) Fixed in 26.15.0
  • Fix · CNA app-builder-lib (electron-userland) Fixed in 26.15.0
  • Fix · GHSA-7g7r-gx96-252g app-builder-lib (npm) Fixed in 26.15.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Build of Podman Desktop
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54672
  2. 2026-10-03 Alias added: GHSA-7g7r-gx96-252g

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2026-39496 Information disclosure in electron-builder CVSS 4.0HIGH 8.2
  • TI-2024-26621 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 CVSS 3.1HIGH 7.5
  • TI-2024-18141 electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only) CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences