CVE-2026-54672: Electron Updater RCE Vulnerability

CVE-2026-54672 Overview

CVE-2026-54672 affects electron-updater, the automatic update library for Electron applications built with app-builder-lib. AppImage targets produced by vulnerable versions include an empty path component when constructing the LD_LIBRARY_PATH environment variable at runtime. An empty entry causes the dynamic linker to treat the current working directory as a trusted library search path. An attacker who places a malicious shared object in the launch directory can load arbitrary code into the AppImage process. The issue is fixed in electron-builder version 26.15.0 and is tracked as an untrusted search path weakness [CWE-427].

Critical Impact
Local attackers can achieve arbitrary code execution inside Electron AppImage processes by dropping a malicious shared library in the working directory used to launch the app.

Affected Products

electron-builder / app-builder-lib prior to 26.15.0
Electron applications packaged as AppImage using vulnerable app-builder-lib builds
electron-updater consumers relying on affected AppImage targets

Discovery Timeline

2026-06-30 - CVE-2026-54672 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54672

Vulnerability Analysis

The flaw lives in the AppImage launch wrapper generated by app-builder-lib. During packaging, the tool composes LD_LIBRARY_PATH by concatenating several directory strings separated by colons. When one of the source variables is unset or empty, the resulting value contains an empty component such as dir1::dir2 or a trailing colon. The GNU dynamic linker (ld.so) interprets an empty entry in LD_LIBRARY_PATH as the current working directory. This introduces an untrusted search path condition that violates the assumptions of the Electron runtime and any bundled native modules.

Root Cause

The root cause is missing sanitization of empty tokens when building the runtime library search list. The generator does not filter unset variables before joining path components, so the resulting LD_LIBRARY_PATH implicitly resolves . as a library source. This is a classic [CWE-427] Uncontrolled Search Path Element issue in a launcher script.

Attack Vector

Exploitation is local and requires low privileges. An attacker stages a malicious shared library, for example libcurl.so.4 or another library name the Electron app resolves at startup, in a directory the victim uses to launch the AppImage. When the user runs the AppImage from that directory, ld.so loads the attacker library before the legitimate system copy. The attacker code executes inside the Electron process with the victim's privileges. Common delivery paths include downloads folders, shared network directories, and USB media.

text

// Patch reference from electron-builder commit 01b8ba979
// The fix ships with electron-builder 26.15.0 and eliminates the empty
// LD_LIBRARY_PATH component in generated AppImage launch wrappers.
// Source: https://github.com/electron-userland/electron-builder/commit/01b8ba979

Detection Methods for CVE-2026-54672

Indicators of Compromise

Unexpected .so files co-located with AppImage binaries in user-writable directories such as ~/Downloads, /tmp, or removable media.
Electron application processes loading shared objects from non-standard paths visible in /proc/<pid>/maps.
LD_LIBRARY_PATH values in process environments containing empty components (:: or leading/trailing :).

Detection Strategies

Audit installed electron-builder and app-builder-lib versions across build hosts and confirm they are at 26.15.0 or later.
Inspect generated AppImage wrapper scripts for LD_LIBRARY_PATH assignments containing empty path elements.
Hunt endpoint telemetry for Electron AppImage executions where the resolved shared library path differs from the AppImage mount point.

Monitoring Recommendations

Alert on writes of shared object files to directories that commonly host AppImage launches.
Log and review execve events with argv[0] pointing to AppImage binaries and correlate with library loads from the same directory.
Track deployment of updated Electron application builds to ensure downstream consumers ingest the fixed release.

How to Mitigate CVE-2026-54672

Immediate Actions Required

Upgrade electron-builder to 26.15.0 or later and rebuild all AppImage artifacts.
Redistribute patched AppImages to end users and invalidate older auto-update channels where feasible.
Instruct users to launch AppImages only from trusted directories until updates are deployed.

Patch Information

The fix is included in electron-builder26.15.0. See the GitHub Security Advisory GHSA-7g7r-gx96-252g and the upstream commit 01b8ba979 for the code change that eliminates the empty LD_LIBRARY_PATH component in AppImage launch wrappers.

Workarounds

Manually edit the AppImage launcher to strip empty entries from LD_LIBRARY_PATH before invoking the Electron binary.
Launch AppImages from a dedicated directory that is not user-writable and contains no attacker-controlled files.
Restrict write access on directories where AppImages are executed using standard filesystem permissions.

bash

# Verify installed electron-builder version and upgrade
npm ls electron-builder
npm install --save-dev electron-builder@^26.15.0

# Sanity-check a generated AppImage wrapper for empty LD_LIBRARY_PATH tokens
strings ./YourApp.AppImage | grep -E 'LD_LIBRARY_PATH=.*(::|=:|:$)'