What is the CVSS score of CVE-2026-54672?

CVE-2026-54672 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of electron-builder are affected by CVE-2026-54672?

electron-builder's app-builder-lib versions prior to 26.15.0 contain a local privilege escalation vulnerability in Linux AppImage bundles that allows arbitrary code execution through malicious shared…. A patch is available.

How to fix or mitigate CVE-2026-54672?

Within 24 hours: Inventory all development and production systems running electron-builder/app-builder-lib, with focus on versions predating 26.15.0 and any deployed AppImage bundles. Within 7 days: Upgrade app-builder-lib to version 26.15.0 or later and rebuild all AppImage artifacts. Within 30 days: Deploy rebuilt AppImage bundles to all affected users and verify version compliance across development, staging, and production pipelines.

electron-builder CVE-2026-54672

EUVD-2026-40456 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-06-30 GitHub_M

GHSA-7g7r-gx96-252g

RCE Electron Builder App Builder Lib

7.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Local search-path hijack needs the victim to launch from the attacker-staged directory, so AV:L and UI:R; attacker-controlled library yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 24, 2026 - 17:48 EUVD

Analysis Generated

Jun 30, 2026 - 23:26 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 npm packages depend on app-builder-lib (7 direct, 0 indirect)

Ecosystem-wide dependent count for version 26.15.0.

DescriptionCVE.org

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.

AnalysisAI

Local arbitrary code execution in electron-builder (app-builder-lib) AppImage targets prior to 26.15.0 occurs because an empty path component in the runtime-set LD_LIBRARY_PATH adds the current working directory to the dynamic linker search path, letting an attacker who can plant a malicious shared library in the AppImage's launch directory hijack library loading. The flaw affects Linux AppImage bundles produced by app-builder-lib (the packaging engine behind electron-builder/electron-updater) and is fixed in 26.15.0. No public exploit identified at time of analysis; CVSS 7.8 reflects high local impact rather than remote exposure.

Technical ContextAI

AppImage is a self-contained Linux application bundle format; electron-builder's app-builder-lib generates the launch wrapper that exports LD_LIBRARY_PATH so bundled Electron libraries resolve at runtime. The bug is a CWE-427 (Uncontrolled Search Path Element): an empty entry in the colon-separated LD_LIBRARY_PATH (e.g. a leading, trailing, or double colon) is interpreted by the glibc dynamic loader (ld.so) as the current working directory ('.'). Any process launching the AppImage from a directory containing an attacker-supplied .so whose name matches a library the app loads will load that library instead of the legitimate one, executing attacker code in the application's context. The affected CPEs are electron-userland:electron-builder and electron-userland:app-builder-lib, both Linux AppImage build outputs.

RemediationAI

Vendor-released patch: 26.15.0 - upgrade app-builder-lib/electron-builder to 26.15.0 or later and rebuild all Linux AppImage targets so the corrected LD_LIBRARY_PATH (without empty components) is emitted, then redistribute the rebuilt artifacts to end users. Rebuilding is essential because existing shipped AppImages retain the vulnerable wrapper even after the toolchain is updated. Until rebuilt, instruct users not to launch AppImages from untrusted, shared, or world-writable directories (e.g. /tmp or a downloads folder another user can write to) and to run them from a dedicated directory containing no untrusted .so files; this reduces but does not fully eliminate risk and may inconvenience users accustomed to running downloads in place. The fix corresponds to commit https://github.com/electron-userland/electron-builder/commit/01b8ba979; details are in advisory GHSA-7g7r-gx96-252g at https://github.com/electron-userland/electron-builder/security/advisories/GHSA-7g7r-gx96-252g.