CVE-2026-54673: electron-updater allows for automatic updates for Electron apps

Routine

MEDIUM 6.5UPGRADEUPGRADE

CVE-2026-54673 is a medium-severity flaw (CVSS 6.5) affecting builder-util-runtime, electron-builder. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not s

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.4% (top 65%)
CISA exploited list	No
Weakness	CWE-200
Published	2026-06-30
Last modified	2026-08-26

Publisher (CNA): GitHub, Inc. · Vendor: electron

Last updated 2026-08-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-06-30 23:17 UTCPublished CVE record published
2026-08-26 19:13 UTCUpdated Record last modified

electron builder-util-runtime UPGRADE

Affected: < 9.7.0

Fixed in: 9.7.0

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls builder-util-runtime

2. UPGRADE to 9.7.0

npm install builder-util-runtime@">=9.7.0"

electron electron-builder UPGRADE

Affected: < 26.15.0

Fixed in: 26.15.0

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls electron-builder

2. UPGRADE to 26.15.0

npm install electron-builder@">=26.15.0"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-54673?

builder-util-runtime: upgrade to 9.7.0; electron-builder: upgrade to 26.15.0. Exact commands for each OS are on this page.

Is CVE-2026-54673 being exploited?

CVE-2026-54673 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-54673 affect?

CVE-2026-54673 affects builder-util-runtime, electron-builder. Severity is medium (CVSS 6.5). electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization"

How urgent is CVE-2026-54673?

Priority 36/100. Public exploit reference

Software pages

GitLab vulnerabilities · Electron vulnerabilities

References

← Back to latest CVEs