CVE-2026-54672: electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.
References
- github.com/advisories/GHSA-7g7r-gx96-252g
- github.com/electron-userland/electron-builder/commit/01b8ba979d1db44543e18d07b4ad94953deb10ea
- github.com/electron-userland/electron-builder/releases/tag/electron-builder@26.15.0
- github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g
- nvd.nist.gov/vuln/detail/CVE-2026-54672
Code Behaviors & Features
Detect and mitigate CVE-2026-54672 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →