Electron AppImage Vulnerability Allows Arbitrary Code Execution via Path Hijacking (CVE-2026-54672)

A critical vulnerability, tracked as CVE-2026-54672, has been identified in app-builder-lib versions prior to 26.15.0 and its upstream dependency app-builder-bin. This flaw affects AppImages built with these toolsets, primarily impacting Linux systems. The vulnerability stems from an uncontrolled search path element in the LD_LIBRARY_PATH environment variable. Specifically, when LD_LIBRARY_PATH is not explicitly set at launch time, the AppRun script generated by app-builder-lib (or app-builder-bin) can introduce an empty path component, effectively adding the current working directory to the dynamic linker's search path. This allows an attacker who can place a malicious shared library (e.g., libfoo.so) in the same directory as a vulnerable AppImage to achieve arbitrary code execution with the privileges of the user who launches the AppImage. This issue is similar to CVE-2024-41817 and underscores the risks associated with dynamic linker search order vulnerabilities.

Attack Chain

1. Vulnerable Application Identification: An attacker identifies a vulnerable AppImage built with app-builder-lib < 26.15.0 or app-builder-bin, present on a Linux system.
2. User-Writable Directory Placement: The attacker finds or manipulates the victim into placing the vulnerable AppImage in a user-writable directory (e.g., /tmp, a user's home directory).
3. Malicious Library Creation: The attacker crafts a malicious shared library (e.g., libfoo.so) designed to perform arbitrary actions, such as establishing a reverse shell or exfiltrating data.
4. Library Deployment: The attacker places the malicious shared library in the same user-writable directory as the vulnerable AppImage.
5. Execution with Compromised Environment: The victim executes the vulnerable AppImage from this compromised directory.
6. Dynamic Linker Path Resolution: During AppImage execution, the AppRun script, due to the vulnerability, sets LD_LIBRARY_PATH with a trailing colon when the variable is unset.
7. Library Hijacking: This trailing colon causes the dynamic linker to include the current working directory in its search path, leading it to load the malicious shared library from that directory instead of the legitimate one.
8. Arbitrary Code Execution: The malicious code within the attacker's shared library is executed with the privileges of the victim user, resulting in arbitrary code execution and potential system compromise.

Impact

Successful exploitation of this vulnerability grants an attacker arbitrary code execution capabilities on the affected Linux system. The code will execute with the privileges of the user who launched the vulnerable AppImage. This can lead to a wide range of malicious activities, including system compromise, data exfiltration, installation of further malware, or lateral movement within the network. Organizations using Electron-based AppImages built with affected versions of app-builder-lib are at risk, particularly if users frequently execute applications from untrusted or world-writable directories.

Recommendation

• Patch app-builder-lib to version 26.15.0 or newer immediately to mitigate CVE-2026-54672 in newly built AppImages.
• Educate users to avoid running AppImage files from world-writable directories such as /tmp or untrusted download locations.
• Ensure that existing vulnerable AppImages (built with app-builder-lib < 26.15.0 or app-builder-bin) are updated or rebuilt with the patched version.
• Set LD_LIBRARY_PATH to a non-empty value before launching AppImages if patching is not immediately possible to prevent the empty path component.