electron-builder

4 results · Clear filters · Feed

• High 7.8
  CVE-2026-54672

  electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

  electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working di…

  electron-userland electron-builder app-builder-lib app-builder-lib npm
  Jun 30, 2026
• High 8.2
  CVE-2026-54673

  electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

  electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credenti…

  electron-userland electron-builder builder-util-runtime builder-util-runtime npm
  Jun 30, 2026
• High 7.5
  CVE-2024-39698

  Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6

  electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding sh…

  electron-userland electron-builder electron-updater npm
  Jul 9, 2024
• High 7.3
  CVE-2024-27303

  electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

  electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to ope…

  electron-userland electron-builder app-builder-lib npm
  Mar 6, 2024