# CVE-2026-54673: Electron electron-builder credential leak via cross-origin redirects

Source: https://junglewise.ai/threats/cve-2026-54673-electron-electron-builder-credential-leak-via-cross-origin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-54673 · Severity: high · CVSS 4 · Published 2026-06-30

A vulnerability in the Electron application update utility can cause sensitive login credentials to be sent to untrusted third-party servers. When an application checks for updates, it may be redirected from a trusted source like GitLab to an external storage provider; during this process, the utility fails to remove certain security tokens from the request headers. An attacker who controls a redirect destination could capture these tokens to gain unauthorized access to private source code or release artifacts.

Technologies: [Electron Userland Electron-Builder](https://junglewise.ai/threats/technologies/electron-builder). Vendors: [Electron Userland](https://junglewise.ai/threats/vendors/electron-userland), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54673 being exploited in the wild.

**How severe is CVE-2026-54673?** High severity, with a CVSS score of 4, published 30 June 2026.

**Which products and versions are affected?** Electron Userland Builder-Util-Runtime < 9.7.0; Electron Userland Electron-Builder < 26.15.0; builder-util-runtime (npm) SEMVER:introduced=0,fixed=9.7.0.

**Is there a fix for CVE-2026-54673?** Yes. builder-util-runtime (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54673 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54673?** Check whether you run Electron Userland Builder-Util-Runtime, Electron Userland Electron-Builder or builder-util-runtime (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- builder-util-runtime (npm): upgrade to 9.7.0 or later

  ```sh
  npm install builder-util-runtime@9.7.0
  ```


## Technical details

A credential disclosure vulnerability exists in the HttpExecutor.prepareRedirectUrlOptions component of builder-util-runtime. The root cause is a case-sensitive property check that only identifies and deletes the exact lowercase 'authorization' header during cross-origin redirects. Other sensitive headers, such as 'PRIVATE-TOKEN' (used by GitLab) or mixed-case 'Authorization' keys, bypass this check and are forwarded to the new origin. An attacker can exploit this by observing or controlling the destination of a 3xx redirect during an update check to capture valid authentication tokens. The issue is fixed in version 9.7.0 of builder-util-runtime by implementing a case-insensitive, separator-agnostic header normalization and registry check.

## Affected products

- electron-userland builder-util-runtime < 9.7.0
- electron-userland electron-builder < 26.15.0

## Identifiers

- CVE-2026-54673
- GHSA-p2f4-r6v6-j797

## Timeline

- 2026-06-16: disclosed
- 2026-06-30: advisory: NVD publication
- 2026-07-24: patched: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/Str1ckl4nd](https://api.github.com/users/Str1ckl4nd)
- [https://github.com/Str1ckl4nd](https://github.com/Str1ckl4nd)
- [https://api.github.com/users/Str1ckl4nd/gists%7B/gist_id%7D](https://api.github.com/users/Str1ckl4nd/gists%7B/gist_id%7D)
- [https://api.github.com/users/Str1ckl4nd/repos](https://api.github.com/users/Str1ckl4nd/repos)
- [https://avatars.githubusercontent.com/u/73695323?v=4](https://avatars.githubusercontent.com/u/73695323?v=4)
- [https://api.github.com/users/Str1ckl4nd/events%7B/privacy%7D](https://api.github.com/users/Str1ckl4nd/events%7B/privacy%7D)

## Related threats

- [electron-userland app-builder-lib uncontrolled search path in AppImage](https://junglewise.ai/threats/cve-2026-54672-electron-userland-app-builder-lib-uncontrolled-search-path-in)
- [electron-builder NSIS installer arbitrary code execution](https://junglewise.ai/threats/cve-2024-27303-electron-builder-nsis-installer-arbitrary-code-execution)