CVE-2026-54673highCWE-200

CVE-2026-54673: falha de alta gravidade em electron-userland builder-util-runtime

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar electron-builder+ Monitorar builder-util-runtime

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.4%
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Produtos afetados
electron-userland · builder-util-runtimeelectron-userland · electron-builder
CVEs relacionadas — electron-userland builder-util-runtime

No mesmo produto, das mais perigosas para as menos.

CVE-2024-39698HIGHCode Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6EPSS 0.4%CVE-2024-27303HIGHelectron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)EPSS 0.3%CVE-2026-54672HIGHelectron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`EPSS 0.2%