CVE-2026-54673

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada electron builder-util-runtime, electron-builder. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

26 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797 advisory vendor · exploit · mitigasi · patch
• https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe patch