# CVE-2026-54672: electron-userland app-builder-lib uncontrolled search path in AppImage

Source: https://junglewise.ai/threats/cve-2026-54672-electron-userland-app-builder-lib-uncontrolled-search-path-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-54672 · Severity: high · CVSS 7.8 · Published 2026-06-30

A vulnerability in the tool used to build Electron applications as AppImages can allow attackers to execute malicious code. If an application is launched from a directory where an attacker can write files (like a shared folder or /tmp), the application may inadvertently load and run a malicious library instead of a legitimate one. This could lead to a full compromise of the user's account and data on the affected system.

Technologies: [Electron Userland Electron-Builder](https://junglewise.ai/threats/technologies/electron-builder). Vendors: [Electron Userland](https://junglewise.ai/threats/vendors/electron-userland), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54672 being exploited in the wild.

**How severe is CVE-2026-54672?** High severity, with a CVSS score of 7.8, published 30 June 2026.

**Which products and versions are affected?** Electron Userland App-Builder-Lib < 26.15.0; Electron Userland Electron-Builder < 26.15.0; app-builder-lib (npm) SEMVER:introduced=0,fixed=26.15.0.

**Is there a fix for CVE-2026-54672?** Yes. app-builder-lib (npm): upgrade to 26.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54672 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54672?** Check whether you run Electron Userland App-Builder-Lib, Electron Userland Electron-Builder or app-builder-lib (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- app-builder-lib (npm): upgrade to 26.15.0 or later

  ```sh
  npm install app-builder-lib@26.15.0
  ```


## Technical details

The vulnerability is an uncontrolled search path element (CWE-427) in the AppRun script generated by app-builder-lib. When constructing environment variables like LD_LIBRARY_PATH, PATH, and XDG_DATA_DIRS, the script fails to handle cases where the existing variable is empty, resulting in a trailing colon (e.g., 'path/to/lib:'). In Linux dynamic linking, a trailing or empty colon entry resolves to the current working directory (CWD). A local attacker can achieve arbitrary code execution with the privileges of the victim by placing a malicious shared library in the CWD from which the AppImage is launched. This affects both the modern TypeScript-based runtime and the legacy Go-based app-builder-bin toolset. The issue is resolved in version 26.15.0.

## Affected products

- electron-userland app-builder-lib < 26.15.0

## Identifiers

- CVE-2026-54672
- GHSA-7g7r-gx96-252g

## Timeline

- 2026-06-16: disclosed: Initial disclosure in electron-builder repository
- 2026-06-16: patched: Fixed in app-builder-lib version 26.15.0
- 2026-07-24: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/sabonerune](https://api.github.com/users/sabonerune)
- [https://github.com/sabonerune](https://github.com/sabonerune)
- [https://api.github.com/users/sabonerune/gists%7B/gist_id%7D](https://api.github.com/users/sabonerune/gists%7B/gist_id%7D)
- [https://api.github.com/users/sabonerune/repos](https://api.github.com/users/sabonerune/repos)
- [https://avatars.githubusercontent.com/u/102559104?v=4](https://avatars.githubusercontent.com/u/102559104?v=4)
- [https://api.github.com/users/sabonerune/events%7B/privacy%7D](https://api.github.com/users/sabonerune/events%7B/privacy%7D)

## Related threats

- [Electron electron-builder credential leak via cross-origin redirects](https://junglewise.ai/threats/cve-2026-54673-electron-electron-builder-credential-leak-via-cross-origin)
- [electron-builder NSIS installer arbitrary code execution](https://junglewise.ai/threats/cve-2024-27303-electron-builder-nsis-installer-arbitrary-code-execution)