Arbitrary Code Execution Vulnerability in Electron Updater by Electron
CVE-2026-54672

7.8HIGH

Key Information:

Vendor

Electron-userland

Status
Electron-builder
App-builder-lib
Vendor
CVE Published:
30 June 2026

What is CVE-2026-54672?

The Electron Updater component for Electron applications is susceptible to an arbitrary code execution vulnerability prior to version 26.15.0. This vulnerability arises from the potential for an empty path component in the LD_LIBRARY_PATH environment variable at runtime when building AppImage targets with app-builder-lib. As a result, the current working directory could inadvertently be included in the dynamic linker search path, enabling an attacker to execute arbitrary code by placing a malicious shared library in the launch directory of the AppImage. The issue has been addressed and resolved in version 26.15.0.

Affected Version(s)

app-builder-lib < 26.15.0

electron-builder < 26.15.0

References

https://github.com/electron-userland/electron-builder/sec...
x_refsource_CONFIRM
https://github.com/electron-userland/electron-builder/com...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.