Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-54672 (CVSS 7.8) electron-updater <26.15.0 allows arbitrary code execution via malicious shared library in AppImage targets. Patch immediately to v26.15.0+ #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/mjeoanXk9M
Post summary
CVE‑2026‑54672 allows arbitrary code execution in electron-updater versions below 26.15.0 through a malicious shared library in AppImage; users are urged to upgrade to 26.15.0 or higher.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | electron | electron-builder | - | node.js | - |