CVE-2026-54673
1 advisory.
npm/builder-util-runtime CVE-2026-54673: high
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Action: Upgrade builder-util-runtime to 9.7.0 or later.
npm i builder-util-runtime@9.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.7.0 | - |
Fixed versions
| 9.7.0 |
Sources
- osv: GHSA-p2f4-r6v6-j797
- https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797
- https://nvd.nist.gov/vuln/detail/CVE-2026-54673
- https://github.com/electron-userland/electron-builder/pull/9834
- https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe
- https://github.com/electron-userland/electron-builder
- https://github.com/electron-userland/electron-builder/releases/tag/electron-builder@26.15.0
CVE-2026-54673 · published · modified · JSON