{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/app-builder-bin/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-54672"},{"cvss":7,"id":"CVE-2024-41817"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["app-builder-lib (\u003c 26.15.0)","app-builder-bin"],"_cs_severities":["high"],"_cs_tags":["electron","appimage","supply-chain","path-hijacking","linux"],"_cs_type":"advisory","_cs_vendors":["Electron Builder Project"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-54672, has been identified in \u003ccode\u003eapp-builder-lib\u003c/code\u003e versions prior to \u003ccode\u003e26.15.0\u003c/code\u003e and its upstream dependency \u003ccode\u003eapp-builder-bin\u003c/code\u003e. This flaw affects AppImages built with these toolsets, primarily impacting Linux systems. The vulnerability stems from an uncontrolled search path element in the \u003ccode\u003eLD_LIBRARY_PATH\u003c/code\u003e environment variable. Specifically, when \u003ccode\u003eLD_LIBRARY_PATH\u003c/code\u003e is not explicitly set at launch time, the \u003ccode\u003eAppRun\u003c/code\u003e script generated by \u003ccode\u003eapp-builder-lib\u003c/code\u003e (or \u003ccode\u003eapp-builder-bin\u003c/code\u003e) can introduce an empty path component, effectively adding the current working directory to the dynamic linker's search path. This allows an attacker who can place a malicious shared library (e.g., \u003ccode\u003elibfoo.so\u003c/code\u003e) in the same directory as a vulnerable AppImage to achieve arbitrary code execution with the privileges of the user who launches the AppImage. This issue is similar to CVE-2024-41817 and underscores the risks associated with dynamic linker search order vulnerabilities.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerable Application Identification\u003c/strong\u003e: An attacker identifies a vulnerable \u003ccode\u003eAppImage\u003c/code\u003e built with \u003ccode\u003eapp-builder-lib \u0026lt; 26.15.0\u003c/code\u003e or \u003ccode\u003eapp-builder-bin\u003c/code\u003e, present on a Linux system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser-Writable Directory Placement\u003c/strong\u003e: The attacker finds or manipulates the victim into placing the vulnerable \u003ccode\u003eAppImage\u003c/code\u003e in a user-writable directory (e.g., \u003ccode\u003e/tmp\u003c/code\u003e, a user's home directory).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Library Creation\u003c/strong\u003e: The attacker crafts a malicious shared library (e.g., \u003ccode\u003elibfoo.so\u003c/code\u003e) designed to perform arbitrary actions, such as establishing a reverse shell or exfiltrating data.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLibrary Deployment\u003c/strong\u003e: The attacker places the malicious shared library in the same user-writable directory as the vulnerable \u003ccode\u003eAppImage\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution with Compromised Environment\u003c/strong\u003e: The victim executes the vulnerable \u003ccode\u003eAppImage\u003c/code\u003e from this compromised directory.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDynamic Linker Path Resolution\u003c/strong\u003e: During \u003ccode\u003eAppImage\u003c/code\u003e execution, the \u003ccode\u003eAppRun\u003c/code\u003e script, due to the vulnerability, sets \u003ccode\u003eLD_LIBRARY_PATH\u003c/code\u003e with a trailing colon when the variable is unset.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLibrary Hijacking\u003c/strong\u003e: This trailing colon causes the dynamic linker to include the current working directory in its search path, leading it to load the malicious shared library from that directory instead of the legitimate one.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary Code Execution\u003c/strong\u003e: The malicious code within the attacker's shared library is executed with the privileges of the victim user, resulting in arbitrary code execution and potential system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants an attacker arbitrary code execution capabilities on the affected Linux system. The code will execute with the privileges of the user who launched the vulnerable AppImage. This can lead to a wide range of malicious activities, including system compromise, data exfiltration, installation of further malware, or lateral movement within the network. Organizations using Electron-based AppImages built with affected versions of \u003ccode\u003eapp-builder-lib\u003c/code\u003e are at risk, particularly if users frequently execute applications from untrusted or world-writable directories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch \u003ccode\u003eapp-builder-lib\u003c/code\u003e to version \u003ccode\u003e26.15.0\u003c/code\u003e or newer immediately to mitigate CVE-2026-54672 in newly built AppImages.\u003c/li\u003e\n\u003cli\u003eEducate users to avoid running \u003ccode\u003eAppImage\u003c/code\u003e files from world-writable directories such as \u003ccode\u003e/tmp\u003c/code\u003e or untrusted download locations.\u003c/li\u003e\n\u003cli\u003eEnsure that existing vulnerable AppImages (built with \u003ccode\u003eapp-builder-lib \u0026lt; 26.15.0\u003c/code\u003e or \u003ccode\u003eapp-builder-bin\u003c/code\u003e) are updated or rebuilt with the patched version.\u003c/li\u003e\n\u003cli\u003eSet \u003ccode\u003eLD_LIBRARY_PATH\u003c/code\u003e to a non-empty value before launching AppImages if patching is not immediately possible to prevent the empty path component.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T14:02:36Z","date_published":"2026-07-24T14:02:36Z","id":"https://feed.craftedsignal.io/briefs/2026-07-appimage-path-hijack/","summary":"A high-severity vulnerability (CVE-2026-54672) in the `app-builder-lib` component of Electron Builder allows an attacker to achieve arbitrary code execution by placing a malicious shared library in the current working directory when a vulnerable AppImage is executed, due to an uncontrolled search path element in the `LD_LIBRARY_PATH` environment variable.","title":"Electron AppImage Vulnerability Allows Arbitrary Code Execution via Path Hijacking (CVE-2026-54672)","url":"https://feed.craftedsignal.io/briefs/2026-07-appimage-path-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - App-Builder-Bin","version":"https://jsonfeed.org/version/1.1"}