CVE-2026-54672

Name of the Vulnerable Software and Affected Versions electron-updater versions prior to 26.15.0

Description AppImage targets built by app-builder-lib can use an empty path component when setting the LD LIBRARY PATH environment variable at runtime. This behavior causes the current working directory to be added to the dynamic linker search path, potentially allowing an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.

Recommendations Update to version 26.15.0 or later.