VDB
CVE-2026-54672
CVE-2026-54672
PUBLISHED
CVSS 7.8 HIGH
Reported by GitHub_M · Published June 30, 2026
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.
Risk Scores
CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| electron-userland | electron-builder | < 26.15.0 |
| electron-userland | app-builder-lib | < 26.15.0 |
| npm | app-builder-lib | 0 |
| electron-userland | app-builder-lib | < 26.15.0, < 26.15.0, < 26.15.0 |
| electron-userland | electron-builder | < 26.15.0, < 26.15.0, < 26.15.0 |
Timeline
- Jun 30, 2026 CVE Published
- Jul 1, 2026 EPSS Score
- Jul 1, 2026 Coalition ESS Score
- Aug 13, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
References
- https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g x_refsource_CONFIRM
- https://github.com/electron-userland/electron-builder/commit/01b8ba979 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-54672 advisory
- https://github.com/advisories/GHSA-7g7r-gx96-252g advisory
- https://github.com/electron-userland/electron-builder/commit/01b8ba979d1db44543e18d07b4ad94953deb10ea fix
- https://github.com/electron-userland/electron-builder/releases/tag/electron-builder@26.15.0 fix