{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/electron-builder--26.15.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-54673"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["builder-util-runtime \u003c 9.7.0","electron-builder \u003c 26.15.0","electron-updater"],"_cs_severities":["high"],"_cs_tags":["credential-access","exfiltration","vulnerability","electron","software-supply-chain","gitlab"],"_cs_type":"advisory","_cs_vendors":["electron-builder","GitLab"],"content_html":"\u003cp\u003eA significant vulnerability, tracked as CVE-2026-54673, has been identified in the \u003ccode\u003ebuilder-util-runtime\u003c/code\u003e package, a core component of \u003ccode\u003eelectron-builder\u003c/code\u003e. This flaw impacts versions of \u003ccode\u003ebuilder-util-runtime\u003c/code\u003e prior to 9.7.0 (and \u003ccode\u003eelectron-builder\u003c/code\u003e prior to v26.15.0). The vulnerability stems from an insufficient credential stripping mechanism within the HTTP redirect handler (\u003ccode\u003eHttpExecutor.prepareRedirectUrlOptions\u003c/code\u003e). Specifically, headers such as \u003ccode\u003ePRIVATE-TOKEN\u003c/code\u003e (used for GitLab personal access tokens) and \u003ccode\u003eAuthorization\u003c/code\u003e when using mixed-case keys were not correctly stripped during cross-origin redirects. This allows sensitive credentials to be inadvertently forwarded to third-party, potentially malicious, redirect destinations. The issue primarily affects updater flows, particularly those interacting with private GitLab instances that commonly redirect asset downloads to external object storage. The vulnerability can lead to unauthorized access to private source code, packages, or release artifacts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe \u003ccode\u003eelectron-updater\u003c/code\u003e component initiates an update check, requesting a release asset from a trusted source, such as a private GitLab instance, while supplying authentication credentials (e.g., \u003ccode\u003ePRIVATE-TOKEN\u003c/code\u003e or \u003ccode\u003eAuthorization\u003c/code\u003e header).\u003c/li\u003e\n\u003cli\u003eThe trusted GitLab origin returns an HTTP 3xx redirect response, directing the client to an external object-storage origin (e.g., S3, GCS) for the asset download.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eHttpExecutor.prepareRedirectUrlOptions\u003c/code\u003e function within \u003ccode\u003ebuilder-util-runtime\u003c/code\u003e is invoked to handle the redirect and conditionally strip sensitive headers.\u003c/li\u003e\n\u003cli\u003eDue to a case-sensitive check, \u003ccode\u003eheaders?.authorization\u003c/code\u003e evaluates to \u003ccode\u003eundefined\u003c/code\u003e for \u003ccode\u003ePRIVATE-TOKEN\u003c/code\u003e or mixed-case \u003ccode\u003eAuthorization\u003c/code\u003e headers.\u003c/li\u003e\n\u003cli\u003eThe sensitive header (e.g., \u003ccode\u003ePRIVATE-TOKEN\u003c/code\u003e or \u003ccode\u003eAuthorization\u003c/code\u003e with mixed casing) is not removed by the vulnerable code path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eelectron-updater\u003c/code\u003e client then issues a request to the cross-origin redirect destination, including the sensitive, unstripped credential header.\u003c/li\u003e\n\u003cli\u003eAn attacker controlling or observing the redirect destination receives the sensitive credential token.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis is a critical credential disclosure vulnerability, CVE-2026-54673, that can inadvertently expose sensitive authentication tokens. Specifically, it can leak GitLab personal access tokens (\u003ccode\u003ePRIVATE-TOKEN\u003c/code\u003e) and Bearer/OAuth tokens when they are sent under a mixed-case \u003ccode\u003eAuthorization\u003c/code\u003e key. Any other custom credential header not exactly named \u0026quot;authorization\u0026quot; in lowercase would also be exposed. The disclosure of a GitLab personal access token grants an attacker the same repository and API permissions as the token itself, leading to unauthorized access to private source code repositories, software packages, and release artifacts. Such access can enable intellectual property theft, code manipulation, or further supply chain attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003ebuilder-util-runtime\u003c/code\u003e to version \u003ccode\u003e9.7.0\u003c/code\u003e or higher immediately, or \u003ccode\u003eelectron-builder\u003c/code\u003e to \u003ccode\u003ev26.15.0\u003c/code\u003e or higher to patch CVE-2026-54673.\u003c/li\u003e\n\u003cli\u003eReview all instances of \u003ccode\u003eelectron-updater\u003c/code\u003e in your environment to ensure they are running patched versions.\u003c/li\u003e\n\u003cli\u003eAvoid using authenticated GitLab updater flows on vulnerable versions (e.g., \u003ccode\u003ebuilder-util-runtime\u003c/code\u003e \u0026lt; 9.7.0).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T14:06:00Z","date_published":"2026-07-24T14:06:00Z","id":"https://feed.craftedsignal.io/briefs/2026-07-electron-updater-credential-leak/","summary":"A vulnerability, CVE-2026-54673, in `electron-builder`'s `builder-util-runtime` package, specifically in its HTTP redirect handler, allows credential headers like `PRIVATE-TOKEN` (GitLab personal access tokens) and mixed-case `Authorization` tokens to be improperly forwarded to attacker-controlled cross-origin redirect destinations, resulting in credential disclosure and enabling unauthorized access to private GitLab resources.","title":"electron-updater Vulnerability Leaks Credentials on Cross-Origin Redirects","url":"https://feed.craftedsignal.io/briefs/2026-07-electron-updater-credential-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Electron-Builder \u003c 26.15.0","version":"https://jsonfeed.org/version/1.1"}