Is CVE-2026-54673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54673 being exploited in the wild.

How severe is CVE-2026-54673?

High severity, with a CVSS score of 4, published 30 June 2026.

Which products and versions are affected?

Electron Userland Builder-Util-Runtime < 9.7.0; Electron Userland Electron-Builder < 26.15.0; builder-util-runtime (npm) SEMVER:introduced=0,fixed=9.7.0.

Is there a fix for CVE-2026-54673?

Yes. builder-util-runtime (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54673 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54673?

Check whether you run Electron Userland Builder-Util-Runtime, Electron Userland Electron-Builder or builder-util-runtime (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54673: Electron electron-builder credential leak via cross-origin redirects

Q: Is there a fix for CVE-2026-54673?

Yes. builder-util-runtime (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54673 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54673?

Check whether you run Electron Userland Builder-Util-Runtime, Electron Userland Electron-Builder or builder-util-runtime (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54673 · Severity: high · CVSS 4 · Published 2026-06-30

A vulnerability in the Electron application update utility can cause sensitive login credentials to be sent to untrusted third-party servers. When an application checks for updates, it may be redirected from a trusted source like GitLab to an external storage provider; during this process, the utility fails to remove certain security tokens from the request headers. An attacker who controls a redirect destination could capture these tokens to gain unauthorized access to private source code or release artifacts.

Technologies: Electron Userland Electron-Builder. Vendors: Electron Userland, npm.

Quick answers

Is CVE-2026-54673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54673 being exploited in the wild.
How severe is CVE-2026-54673?: High severity, with a CVSS score of 4, published 30 June 2026.
Which products and versions are affected?: Electron Userland Builder-Util-Runtime < 9.7.0; Electron Userland Electron-Builder < 26.15.0; builder-util-runtime (npm) SEMVER:introduced=0,fixed=9.7.0.
Is there a fix for CVE-2026-54673?: Yes. builder-util-runtime (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54673 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54673?: Check whether you run Electron Userland Builder-Util-Runtime, Electron Userland Electron-Builder or builder-util-runtime (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

builder-util-runtime (npm): upgrade to 9.7.0 or later
```
npm install builder-util-runtime@9.7.0
```

Technical details

A credential disclosure vulnerability exists in the HttpExecutor.prepareRedirectUrlOptions component of builder-util-runtime. The root cause is a case-sensitive property check that only identifies and deletes the exact lowercase 'authorization' header during cross-origin redirects. Other sensitive headers, such as 'PRIVATE-TOKEN' (used by GitLab) or mixed-case 'Authorization' keys, bypass this check and are forwarded to the new origin. An attacker can exploit this by observing or controlling the destination of a 3xx redirect during an update check to capture valid authentication tokens. The issue is fixed in version 9.7.0 of builder-util-runtime by implementing a case-insensitive, separator-agnostic header normalization and registry check.

Affected products

electron-userland builder-util-runtime < 9.7.0
electron-userland electron-builder < 26.15.0

Identifiers

CVE-2026-54673
GHSA-p2f4-r6v6-j797

Timeline

2026-06-16: disclosed
2026-06-30: advisory: NVD publication
2026-07-24: patched: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.