Skip to content
Threat Feed
Subscribe

Product

Electron-Updater

1 brief RSS
high advisory

electron-updater Vulnerability Leaks Credentials on Cross-Origin Redirects

A vulnerability, CVE-2026-54673, in `electron-builder`'s `builder-util-runtime` package, specifically in its HTTP redirect handler, allows credential headers like `PRIVATE-TOKEN` (GitLab personal access tokens) and mixed-case `Authorization` tokens to be improperly forwarded to attacker-controlled cross-origin redirect destinations, resulting in credential disclosure and enabling unauthorized access to private GitLab resources.

builder-util-runtime < 9.7.0 +2 credential-access exfiltration vulnerability electron software-supply-chain gitlab
2t 1c