Vulnerability · Published Jun 30, 2026 · Assigned by GitHub_M
CVE-2026-54672electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
High 7.8
In plain English
A high-severity uncontrolled search path in app-builder-lib from electron-userland. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | app-builder-lib | 26.15.0 | GHSA-7g7r-gx96-252g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| electron-userland | electron-builder | < 26.15.0 |
| electron-userland | app-builder-lib | < 26.15.0 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H