Is CVE-2026-54672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54672 being exploited in the wild.

How severe is CVE-2026-54672?

High severity, with a CVSS score of 7.8, published 30 June 2026.

Which products and versions are affected?

Electron Userland App-Builder-Lib < 26.15.0; Electron Userland Electron-Builder < 26.15.0; app-builder-lib (npm) SEMVER:introduced=0,fixed=26.15.0.

Is there a fix for CVE-2026-54672?

Yes. app-builder-lib (npm): upgrade to 26.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54672 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54672?

Check whether you run Electron Userland App-Builder-Lib, Electron Userland Electron-Builder or app-builder-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54672: electron-userland app-builder-lib uncontrolled search path in AppImage

Q: Is there a fix for CVE-2026-54672?

Yes. app-builder-lib (npm): upgrade to 26.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54672 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-54672?

Check whether you run Electron Userland App-Builder-Lib, Electron Userland Electron-Builder or app-builder-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54672 · Severity: high · CVSS 7.8 · Published 2026-06-30

A vulnerability in the tool used to build Electron applications as AppImages can allow attackers to execute malicious code. If an application is launched from a directory where an attacker can write files (like a shared folder or /tmp), the application may inadvertently load and run a malicious library instead of a legitimate one. This could lead to a full compromise of the user's account and data on the affected system.

Technologies: Electron Userland Electron-Builder. Vendors: Electron Userland, npm.

Quick answers

Is CVE-2026-54672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54672 being exploited in the wild.
How severe is CVE-2026-54672?: High severity, with a CVSS score of 7.8, published 30 June 2026.
Which products and versions are affected?: Electron Userland App-Builder-Lib < 26.15.0; Electron Userland Electron-Builder < 26.15.0; app-builder-lib (npm) SEMVER:introduced=0,fixed=26.15.0.
Is there a fix for CVE-2026-54672?: Yes. app-builder-lib (npm): upgrade to 26.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54672 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54672?: Check whether you run Electron Userland App-Builder-Lib, Electron Userland Electron-Builder or app-builder-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

app-builder-lib (npm): upgrade to 26.15.0 or later
```
npm install app-builder-lib@26.15.0
```

Technical details

The vulnerability is an uncontrolled search path element (CWE-427) in the AppRun script generated by app-builder-lib. When constructing environment variables like LD_LIBRARY_PATH, PATH, and XDG_DATA_DIRS, the script fails to handle cases where the existing variable is empty, resulting in a trailing colon (e.g., 'path/to/lib:'). In Linux dynamic linking, a trailing or empty colon entry resolves to the current working directory (CWD). A local attacker can achieve arbitrary code execution with the privileges of the victim by placing a malicious shared library in the CWD from which the AppImage is launched. This affects both the modern TypeScript-based runtime and the legacy Go-based app-builder-bin toolset. The issue is resolved in version 26.15.0.

Affected products

electron-userland app-builder-lib < 26.15.0

Identifiers

CVE-2026-54672
GHSA-7g7r-gx96-252g

Timeline

2026-06-16: disclosed: Initial disclosure in electron-builder repository
2026-06-16: patched: Fixed in app-builder-lib version 26.15.0
2026-07-24: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.