CVE-2026-54673highCWE-200

CVE-2026-54673: high-severity vulnerability in electron-userland builder-util-runtime

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Published · Updated

Follow this CVE+ Monitor electron-builder+ Monitor builder-util-runtime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
electron-userland · builder-util-runtimeelectron-userland · electron-builder
Related CVEs — electron-userland builder-util-runtime

In the same product, most dangerous first.

CVE-2024-39698HIGHCode Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6EPSS 0.4%CVE-2024-27303HIGHelectron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)EPSS 0.3%CVE-2026-54672HIGHelectron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`EPSS 0.2%