Skip to content
OpenAdvisories

Vendor

electron-userland

4 known vulnerabilities.

Products

electron-builder 4 builder-util-runtime 1 app-builder-lib 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.8
    CVE-2026-54672

    electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

    electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working di…

    electron-userland electron-builder app-builder-lib app-builder-lib npm
  • High 8.2
    CVE-2026-54673

    electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

    electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credenti…

    electron-userland electron-builder builder-util-runtime builder-util-runtime npm
  • High 7.5
    CVE-2024-39698

    Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6

    electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding sh…

    electron-userland electron-builder electron-updater npm
  • High 7.3
    CVE-2024-27303

    electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

    electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to ope…

    electron-userland electron-builder app-builder-lib npm