{"id":"CVE-2026-54672","aliases":["EUVD-2026-40456","GHSA-7g7r-gx96-252g","openSUSE-SU-2026:11200-1"],"status":"published","title":"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`","description":"electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00186,"percentile":0.08335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2026-06-30T22:15:03Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"npm","package":"app-builder-lib","fixed_in":["26.15.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"app-builder-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.15.0"}]}]},{"source":"osv","ecosystem":"npm","package":"app-builder-lib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"26.15.0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"heroic-games-launcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-4.1"}]}],"bundled":3}],"products":[{"vendor":"electron","product":"electron-builder"},{"vendor":"electron-userland","product":"app-builder-lib"},{"vendor":"electron-userland","product":"electron-builder"}],"references":[{"url":"https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g","tags":["x_refsource_CONFIRM","Vendor Advisory","Exploit","advisory","web"]},{"url":"https://github.com/electron-userland/electron-builder/commit/01b8ba979","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54672","tags":["advisory"]},{"url":"https://github.com/electron-userland/electron-builder/commit/01b8ba979d1db44543e18d07b4ad94953deb10ea","tags":["web"]},{"url":"https://github.com/electron-userland/electron-builder/releases/tag/electron-builder@26.15.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7g7r-gx96-252g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54672.json","tags":["advisory"]},{"url":"https://github.com/electron-userland/electron-builder","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56876","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-54672","title":"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`","description":"electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.","status":"published","published":"2026-06-30T22:15:03.264Z","modified":"2026-07-01T13:47:40.124Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-40456","description":"electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.","status":"published","published":"2026-06-30T22:15:03Z","modified":"2026-07-01T13:47:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:20.297775Z"}],"ghsa":[{"id":"GHSA-7g7r-gx96-252g","title":"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`","description":"### Summary\n\n`AppImage` targets built by `app-builder-lib` could use an empty path component when setting the `LD_LIBRARY_PATH` environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the `AppImage` is launched.\n\nThis vulnerability is the same class as [`CVE-2024-41817`](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8).\n\n### Details\n\nThe vulnerability existed in two independent code paths within `app-builder-lib` (toolset `1.0.0`) and through upstream dependency `app-builder-bin` (toolset `0.0.0`).\n\n#### Path 1 — Modern static runtime (`AppRun` generated by TypeScript)\n\nThe `AppRun` script generated by `app-builder-lib` contained this line:\n\n```bash\nexport LD_LIBRARY_PATH=\"${APPDIR}/usr/lib:${LD_LIBRARY_PATH}\"\n```\n\nWhen `LD_LIBRARY_PATH` is not set in the environment at launch time, this evaluates to:\n\n```\n/path/to/app.AppDir/usr/lib:\n```\n\nThe trailing `:` is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared library (e.g., `libfoo.so`) in the directory from which the `AppImage` is executed, that library will be loaded in place of the legitimate one, resulting in arbitrary code execution.\n\nThe same issue affected `PATH`, `XDG_DATA_DIRS`, and `GSETTINGS_SCHEMA_DIR` in the same script.\n\n```bash\nexport LD_LIBRARY_PATH=\"${APPDIR}/usr/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}\"\n```\n\n#### Path 2 — Legacy FUSE2 toolset (`app-builder-bin`)\n\n`AppImage` targets built using the legacy FUSE2 toolset (`toolsets.appimage = \"0.0.0\"`) delegated `AppRun` script generation to the `app-builder-bin` Go binary, which contained the same vulnerable template:\n\nhttps://github.com/develar/app-builder/blob/7004925f95d8f034fc88d7e782c9aa7583debb8e/pkg/package-format/appimage/templates/AppRun.sh#L27\n\n### Impact\n\nAn attacker with the ability to write files to the directory from which a vulnerable `AppImage` is executed can cause arbitrary shared libraries to be loaded into the application process, resulting in arbitrary code execution with the privileges of the user running the `AppImage`.\n\n### Affected Versions\n\nThis was fully resolved in **`app-builder-lib@26.15.0`** (commit [`01b8ba979`](https://github.com/electron-userland/electron-builder/commit/01b8ba979), PR [#9829](https://github.com/electron-userland/electron-builder/pull/9829)) when `app-builder-bin` was removed from the dependency tree entirely and all AppImage construction was migrated to the TypeScript implementation.\n\n### Workarounds\n\nSet `LD_LIBRARY_PATH` to a non-empty value before launching the `AppImage`, so that the concatenation does not produce an empty path component. Alternatively, avoid running `AppImage` files from world-writable directories such as `/tmp`.","status":"published","published":"2026-07-24T14:00:59Z","modified":"2026-07-24T14:00:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:40:52.46233Z"}],"nvd":[{"id":"CVE-2026-54672","description":"electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.","status":"published","published":"2026-06-30T23:17:27.863Z","modified":"2026-08-18T17:37:49.477Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:12:26.866638Z"}],"osv":[{"id":"CVE-2026-54672","title":"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`","description":"electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.","status":"published","published":"2026-06-30T22:15:03.264Z","modified":"2026-10-28T02:31:02.252330347Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-7g7r-gx96-252g","title":"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`","description":"### Summary\n\n`AppImage` targets built by `app-builder-lib` could use an empty path component when setting the `LD_LIBRARY_PATH` environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the `AppImage` is launched.\n\nThis vulnerability is the same class as [`CVE-2024-41817`](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8).\n\n### Details\n\nThe vulnerability existed in two independent code paths within `app-builder-lib` (toolset `1.0.0`) and through upstream dependency `app-builder-bin` (toolset `0.0.0`).\n\n#### Path 1 — Modern static runtime (`AppRun` generated by TypeScript)\n\nThe `AppRun` script generated by `app-builder-lib` contained this line:\n\n```bash\nexport LD_LIBRARY_PATH=\"${APPDIR}/usr/lib:${LD_LIBRARY_PATH}\"\n```\n\nWhen `LD_LIBRARY_PATH` is not set in the environment at launch time, this evaluates to:\n\n```\n/path/to/app.AppDir/usr/lib:\n```\n\nThe trailing `:` is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared library (e.g., `libfoo.so`) in the directory from which the `AppImage` is executed, that library will be loaded in place of the legitimate one, resulting in arbitrary code execution.\n\nThe same issue affected `PATH`, `XDG_DATA_DIRS`, and `GSETTINGS_SCHEMA_DIR` in the same script.\n\n```bash\nexport LD_LIBRARY_PATH=\"${APPDIR}/usr/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}\"\n```\n\n#### Path 2 — Legacy FUSE2 toolset (`app-builder-bin`)\n\n`AppImage` targets built using the legacy FUSE2 toolset (`toolsets.appimage = \"0.0.0\"`) delegated `AppRun` script generation to the `app-builder-bin` Go binary, which contained the same vulnerable template:\n\nhttps://github.com/develar/app-builder/blob/7004925f95d8f034fc88d7e782c9aa7583debb8e/pkg/package-format/appimage/templates/AppRun.sh#L27\n\n### Impact\n\nAn attacker with the ability to write files to the directory from which a vulnerable `AppImage` is executed can cause arbitrary shared libraries to be loaded into the application process, resulting in arbitrary code execution with the privileges of the user running the `AppImage`.\n\n### Affected Versions\n\nThis was fully resolved in **`app-builder-lib@26.15.0`** (commit [`01b8ba979`](https://github.com/electron-userland/electron-builder/commit/01b8ba979), PR [#9829](https://github.com/electron-userland/electron-builder/pull/9829)) when `app-builder-bin` was removed from the dependency tree entirely and all AppImage construction was migrated to the TypeScript implementation.\n\n### Workarounds\n\nSet `LD_LIBRARY_PATH` to a non-empty value before launching the `AppImage`, so that the concatenation does not produce an empty path component. Alternatively, avoid running `AppImage` files from world-writable directories such as `/tmp`.","status":"published","published":"2026-07-24T14:00:59Z","modified":"2026-07-24T14:15:41.360907768Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"openSUSE-SU-2026:11200-1","title":"heroic-games-launcher-2.22.0-4.1 on GA media","description":"These are all security issues fixed in the heroic-games-launcher-2.22.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-07T00:00:00Z","modified":"2026-07-09T10:00:07.077506571Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}