electron-builder CVE-2026-54672

Exploitation requires the AppImage to have been built by a vulnerable app-builder-lib/electron-builder version (prior to 26.15.0) such that LD_LIBRARY_PATH contains an empty path component, the attacker to have write access to the directory from which the AppImage is launched in order to place a malicious shared library matching a loaded library name, and the victim to launch that AppImage from that same working directory. Limiting factors: this is local-only (no remote vector), depends on the victim's launch directory being attacker-writable, requires the dropped library name to match one resolved at runtime, and applies only to the Linux AppImage target - not to Windows/macOS builds or other package formats.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) is internally consistent with a local search-path hijack: local attack vector, low complexity, and low privileges (the attacker needs the ability to drop a file in the launch directory and the victim to run the AppImage from there). This is not a network-exploitable or wormable issue, so despite the High base score the real-world urgency is moderate and situational - it matters most on multi-user systems or where AppImages are launched from shared/world-writable or download directories. No EPSS score, KEV listing, or SSVC decision data was provided; absent those signals, exploitation appears opportunistic rather than mass-scale. No public exploit identified at time of analysis. The chief uncertainty is the practical UI element: realistically the victim must launch the AppImage from the attacker-controlled directory, which the AV:L/UI:N vector does not fully capture - verify the launch-context assumption against deployment.

An attacker drops a malicious shared library (named to match one the Electron app loads) into a directory a victim is likely to run an AppImage from - such as a shared download folder or /tmp on a multi-user host. When the victim launches the vulnerable AppImage from that directory, the empty LD_LIBRARY_PATH component causes ld.so to load the attacker's .so from the current directory, executing code as the victim. No public POC is identified, and the local attack vector with low complexity makes this practical wherever an attacker can pre-stage files in the launch directory.