# CVE-2024-27303: electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

> An attacker can execute arbitrary code on Windows by placing a malicious cmd.exe in the installer directory, exploiting unsafe path resolution in electron-builder.

- **Severity:** High 7.3 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 6 Mar 2024
- **Updated:** 13 Aug 2024
- **Also known as:** GHSA-r4pf-3v7r-hh55, openSUSE-SU-2024:13782-1

## What is CVE-2024-27303?

CVE-2024-27303 is a high-severity command injection vulnerability in electron-userland electron-builder, published on 6 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.

Weakness: CWE-427 (Uncontrolled Search Path Element), CWE-426 (Untrusted Search Path)

## Which versions are affected by CVE-2024-27303?

2 open source packages ship an affected version, including app-builder-lib. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `app-builder-lib` | npm | All versions | 24.13.2 |
| `app-builder-lib` | npm | All versions | 24.13.2 |
| `teleport` | openSUSE:Tumbleweed | All versions | 15.1.6-1.1 |

Products: Electron Electron-Builder.

## How do I fix CVE-2024-27303?

Upgrade app-builder-lib to 24.13.2 or later.

## Is CVE-2024-27303 being exploited?

There is no known exploitation of CVE-2024-27303 in the wild and no public exploit code.

## Other vulnerabilities in electron-userland electron-builder

- [CVE-2026-54672](https://insights.sbomify.com/CVE-2026-54672/): electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` (high 7.8)
- [CVE-2024-39698](https://insights.sbomify.com/CVE-2024-39698/): Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 (high 7.5)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-27303 and fix it if it is affected.

What it is: CVE-2024-27303 is a high-severity command injection vulnerability in electron-userland electron-builder, published on 6 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2024-27303 in the wild and no public exploit code.

Affected packages and fixed versions:
- app-builder-lib (npm): affected all versions; fixed in 24.13.2
- app-builder-lib (npm): affected all versions; fixed in 24.13.2

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-27303/ (Markdown: https://insights.sbomify.com/CVE-2024-27303/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-27303
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27303
- OSV: https://osv.dev/vulnerability/CVE-2024-27303

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-27303/
Summaries are generated and may contain mistakes; the official description above is the record.