Vulnerability in Electron Electron-Builder
CVE-2026-54672
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (7.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 7.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Electron Electron-Builder
- Electron-Userland App-Builder-Lib — versions < 26.15.0
- Electron-Userland Electron-Builder — versions < 26.15.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-54672?
- CVE-2026-54672 is a high-severity vulnerability in Electron Electron-Builder, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2026-06-30.
- How severe is CVE-2026-54672?
- High severity. CVSS v3 base score is 7.8 out of 10.