Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T22:15:03 electron-updater: app-builder-lib: Electron-updater: Arbitrary code execution through AppImage library loading vulnerability 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CWE-427

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.

A flaw was found in electron-updater, a component used for automatic updates in Electron applications. This vulnerability arises because AppImage targets, built by app-builder-lib, incorrectly add the current working directory to the dynamic linker search path when setting the LD_LIBRARY_PATH environment variable. An attacker could exploit this by placing a malicious program in the same directory as an AppImage, which would then be executed when the AppImage is launched. This could allow the attacker to run arbitrary code on the affected system.

The vulnerability in electron-builder's AppImage packaging only affects applications distributed as AppImage format, where an empty LD_LIBRARY_PATH component causes the current working directory to be added to the dynamic linker search path. Red Hat products that bundle electron-builder components are not affected: the goose RPM is distributed as an RPM package (not AppImage), and Podman Desktop uses Flatpak and tar.gz targets on Linux (AppImage is not configured in its electron-builder config). The vulnerable AppImage code path is never exercised in any Red Hat product. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Build of Podman Desktop Not affected rh-podman-desktop.git Red Hat Enterprise Linux 10 Not affected goose Red Hat Enterprise Linux 9 Not affected goose https://www.cve.org/CVERecord?id=CVE-2026-54672 https://nvd.nist.gov/vuln/detail/CVE-2026-54672 https://github.com/electron-userland/electron-builder/commit/01b8ba979 https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g