CVE-2026-54672 is a high-severity (CVSS 7.8) CWE-427 vulnerability in app-builder-lib. A fix is available for app-builder-lib — see the affected versions and patch details below.
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-54672 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 381,682 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
app-builder-libnpmDescription
Summary
AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.
This vulnerability is the same class as CVE-2024-41817.
Details
The vulnerability existed in two independent code paths within app-builder-lib (toolset 1.0.0) and through upstream dependency app-builder-bin (toolset 0.0.0).
Path 1 — Modern static runtime (AppRun generated by TypeScript)
The AppRun script generated by app-builder-lib contained this line:
export LD_LIBRARY_PATH="${APPDIR}/usr/lib:${LD_LIBRARY_PATH}"
When LD_LIBRARY_PATH is not set in the environment at launch time, this evaluates to:
/path/to/app.AppDir/usr/lib:
The trailing : is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared library (e.g., libfoo.so) in the directory from which the AppImage is executed, that library will be loaded in place of the legitimate one, resulting in arbitrary code execution.
The same issue affected PATH, XDG_DATA_DIRS, and GSETTINGS_SCHEMA_DIR in the same script.
export LD_LIBRARY_PATH="${APPDIR}/usr/lib${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}"
Path 2 — Legacy FUSE2 toolset (app-builder-bin)
AppImage targets built using the legacy FUSE2 toolset (toolsets.appimage = "0.0.0") delegated AppRun script generation to the app-builder-bin Go binary, which contained the same vulnerable template:
Impact
An attacker with the ability to write files to the directory from which a vulnerable AppImage is executed can cause arbitrary shared libraries to be loaded into the application process, resulting in arbitrary code execution with the privileges of the user running the AppImage.
Affected Versions
This was fully resolved in [email protected] (commit 01b8ba979, PR #9829) when app-builder-bin was removed from the dependency tree entirely and all AppImage construction was migrated to the TypeScript implementation.
Workarounds
Set LD_LIBRARY_PATH to a non-empty value before launching the AppImage, so that the concatenation does not produce an empty path component. Alternatively, avoid running AppImage files from world-writable directories such as /tmp.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | app-builder-lib | all versions | 26.15.0npm install app-builder-lib@26.15.0 |
Affected Products
electron-builderelectronDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for app-builder-lib, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update app-builder-lib to 26.15.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54672 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
The vulnerability in electron-builder's AppImage packaging only affects applications distributed as AppImage format, where an empty LD_LIBRARY_PATH component causes the current working directory to be added to the dynamic linker search path. Red Hat products that bundle electron-builder components are not affected:…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.Source: Red Hat security advisory for CVE-2026-54672 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-54672 in your dependencies?
Find it across npm, including transitive dependencies.