CVE-2026-54673: electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
In electron-builder’s builder-util-runtime package, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab’s personal access token flow) and mixed-case Authorization (used by GitLab’s Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination.
References
- github.com/advisories/GHSA-p2f4-r6v6-j797
- github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe
- github.com/electron-userland/electron-builder/pull/9834
- github.com/electron-userland/electron-builder/releases/tag/electron-builder@26.15.0
- github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797
- nvd.nist.gov/vuln/detail/CVE-2026-54673
Code Behaviors & Features
Detect and mitigate CVE-2026-54673 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →