CVE-2026-54672

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54672", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T22:53:58.560Z", "datePublished": "2026-06-30T22:15:03.264Z", "dateUpdated": "2026-07-01T13:47:40.124Z"}, "containers": {"cna": {"title": "electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`", "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "lang": "en", "description": "CWE-427: Uncontrolled Search Path Element", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g"}, {"name": "https://github.com/electron-userland/electron-builder/commit/01b8ba979", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron-userland/electron-builder/commit/01b8ba979"}], "affected": [{"vendor": "electron-userland", "product": "electron-builder", "versions": [{"version": "< 26.15.0", "status": "affected"}]}, {"vendor": "electron-userland", "product": "app-builder-lib", "versions": [{"version": "< 26.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T22:15:03.264Z"}, "descriptions": [{"lang": "en", "value": "electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0."}], "source": {"advisory": "GHSA-7g7r-gx96-252g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T13:47:32.923006Z", "id": "CVE-2026-54672", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T13:47:40.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T13:47:32.923006Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T13:47:36.699Z"}}], "cna": {"title": "electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`", "source": {"advisory": "GHSA-7g7r-gx96-252g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "electron-userland", "product": "electron-builder", "versions": [{"status": "affected", "version": "< 26.15.0"}]}, {"vendor": "electron-userland", "product": "app-builder-lib", "versions": [{"status": "affected", "version": "< 26.15.0"}]}], "references": [{"url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g", "name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/electron-userland/electron-builder/commit/01b8ba979", "name": "https://github.com/electron-userland/electron-builder/commit/01b8ba979", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T22:15:03.264Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54672", "state": "PUBLISHED", "dateUpdated": "2026-07-01T13:47:40.124Z", "dateReserved": "2026-06-15T22:53:58.560Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-30T22:15:03.264Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "electron-builder", "vendor": "electron-userland", "versions": [{"status": "affected", "version": "< 26.15.0"}]}, {"product": "app-builder-lib", "vendor": "electron-userland", "versions": [{"status": "affected", "version": "< 26.15.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electron:electron-builder:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C6507110-8625-4E1F-B5EA-42E83DE9554D", "versionEndExcluding": "26.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0."}], "id": "CVE-2026-54672", "lastModified": "2026-08-18T17:37:49.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54672", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T13:47:32.923006Z", "version": "2.0.3"}}]}, "published": "2026-06-30T23:17:27.863", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron-userland/electron-builder/commit/01b8ba979"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory", "Exploit"], "url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electron-updater: app-builder-lib: Electron-updater: Arbitrary code execution through AppImage library loading vulnerability", "id": "2495426", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495426"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-427", "details": ["A flaw was found in electron-updater, a component used for automatic updates in Electron applications. This vulnerability arises because AppImage targets, built by app-builder-lib, incorrectly add the current working directory to the dynamic linker search path when setting the LD_LIBRARY_PATH environment variable. An attacker could exploit this by placing a malicious program in the same directory as an AppImage, which would then be executed when the AppImage is launched. This could allow the attacker to run arbitrary code on the affected system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-54672", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Not affected", "package_name": "rh-podman-desktop.git", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "goose", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "goose", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-30T22:15:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54672\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54672\nhttps://github.com/electron-userland/electron-builder/commit/01b8ba979\nhttps://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g"], "statement": "The vulnerability in electron-builder's AppImage packaging only affects applications distributed as AppImage format, where an empty LD_LIBRARY_PATH component causes the current working directory to be added to the dynamic linker search path. Red Hat products that bundle electron-builder components are not affected: the goose RPM is distributed as an RPM package (not AppImage), and Podman Desktop uses Flatpak and tar.gz targets on Linux (AppImage is not configured in its electron-builder config). The vulnerable AppImage code path is never exercised in any Red Hat product.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "app-builder-lib", "source": "cna", "vendor": "electron-userland"}, "product": "app-builder-lib", "vendor": "electron-userland"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "electron-builder", "vendor": "electron-userland"}], "created": "2026-06-30T23:30:04.839236+00:00", "updated": "2026-07-01T10:00:50.700567+00:00", "vendors": ["electron-userland", "electron-userland$PRODUCT$app-builder-lib", "electron-userland$PRODUCT$electron-builder"]}