CVE-2026-54673 Details
Description
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.
A vulnerability in the electron-updater package of electron-builder, prior to version 9.7.0, allows for the leakage of credentials through HTTP redirects. The issue arises because the redirect handler only removes the 'authorization' header when it is in lowercase, failing to strip other credential-bearing headers like 'PRIVATE-TOKEN' and mixed-case 'Authorization'. This oversight can result in sensitive information being forwarded to attacker-controlled cross-origin destinations, particularly in GitLab-related update processes.
Users can upgrade to electron-builder version 26.15.0 or later, which includes the necessary fix. Instructions for updating can be found in the electron-builder documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797 | CISA-ADP | Vendor AdvisoryExploitMitigationPatch |
| https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe | [email protected] | Patch |
| https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797 | [email protected] | Vendor AdvisoryExploitMitigationPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electron builder-util-runtime | < 9.7.0 |
CPE
Remediation
| |
| electron electron-builder | < 26.15.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |