Which versions of electron-updater are affected by CVE-2026-54673?

electron-updater versions before 9.7.0, embedded in Electron-based applications, expose a credential leakage vulnerability (CVSS 8.2) that allows attackers controlling HTTP redirects to intercept…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54673?

Yes, a public proof-of-concept exploit is available for CVE-2026-54673. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-54673?

24 hours: Identify all Electron applications in production and development using electron-updater versions prior to 9.7.0. 7 days: Upgrade all affected applications to electron-updater version 9.7.0 or later in coordination with development and deployment teams. 30 days: Rotate all GitLab personal access tokens and OAuth credentials that may have been exposed through update feed channels and audit access logs for unauthorized activity.

electron-updater CVE-2026-54673

Q: What is the CVSS score of CVE-2026-54673?

CVE-2026-54673 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40455 HIGH

Information Exposure (CWE-200)

2026-06-30 GitHub_M

GHSA-p2f4-r6v6-j797

Gitlab Information Disclosure Electron Builder Builder Util Runtime

8.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network redirect with low complexity; requires a credentialed feed (PR:L) and an update check (UI:R); credential crosses into attacker origin (S:C) for high confidentiality, no integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 24, 2026 - 17:48 EUVD

Analysis Generated

Jun 30, 2026 - 23:26 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

377 npm packages depend on builder-util-runtime (25 direct, 354 indirect)

Ecosystem-wide dependent count for version 9.7.0.

DescriptionCVE.org

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers - most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) - were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

AnalysisAI

Credential leakage in electron-updater (the auto-update component of electron-builder / builder-util-runtime) before 9.7.0 allows an attacker controlling a redirect target to harvest update-feed credentials. The HTTP redirect handler only stripped a header keyed exactly as lowercase "authorization", so PRIVATE-TOKEN (GitLab personal access tokens) and mixed-case Authorization (GitLab Bearer/OAuth) headers were forwarded to attacker-controlled cross-origin redirect destinations. There is no public exploit identified at time of analysis, but the upstream fix is published in version 9.7.0.

Technical ContextAI

electron-updater is the runtime module within the electron-builder ecosystem that performs in-app automatic updates for Electron desktop applications, fetching update metadata and binaries over HTTP(S) from feeds such as GitLab, GitHub, or generic servers. The flaw lives in HttpExecutor.prepareRedirectUrlOptions, the routine that rebuilds request options when the server returns a 3xx redirect. To prevent credential leakage across origins, this routine is supposed to drop authentication headers before following a redirect to a different host, but its matching logic compared the header key against the literal lowercase string "authorization" only. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): because HTTP header names are case-insensitive and GitLab additionally uses a separate PRIVATE-TOKEN header for personal access tokens, any credential header not spelled exactly "authorization" survived the redirect and was replayed to the new, potentially attacker-controlled, origin.

RemediationAI

Upgrade the electron-updater / builder-util-runtime dependency to version 9.7.0 or later, which corrects the header-stripping logic to remove all credential-bearing headers (case-insensitive Authorization and PRIVATE-TOKEN) before following a cross-origin redirect; this is the primary and complete fix (Vendor-released patch: 9.7.0, commit https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe, advisory https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797). Where an immediate upgrade is not possible, reduce exposure by hosting update feeds on endpoints you fully control that do not issue cross-origin redirects, and by scoping the GitLab personal access tokens used for updates to read-only, least-privilege roles so a leaked token is less damaging - the trade-off is operational overhead and that these are mitigations, not a fix. Rotate any update-feed tokens that may already have been exposed.