CVE-2026-54672 electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
An attacker can execute arbitrary code by placing a malicious shared library in the launch directory due to unsafe LD_LIBRARY_PATH handling in Electron AppImages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54672?
CVE-2026-54672 is a high-severity code injection vulnerability in electron-userland app-builder-lib, published on 30 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.
Weakness: CWE-427
Which versions are affected by CVE-2026-54672?
2 open source packages ship an affected version, including app-builder-lib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
app-builder-lib npm | All versions | 26.15.0 |
app-builder-lib npm | All versions | 26.15.0 |
Products include Electron Electron-Builder.
How do I fix CVE-2026-54672?
Upgrade app-builder-lib to 26.15.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-54672 being exploited?
There is no known exploitation of CVE-2026-54672 in the wild and no public exploit code.
Other vulnerabilities in electron-userland app-builder-lib
Sources
Also known as GHSA-7g7r-gx96-252g.