CVE-2026-54673

Medium

Description

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

SeverityMedium

CVSS6.5

Exploit probability—

ProductElectron Builder-util-runtime

PublishedJun 30, 2026

First seenJun 30, 2026

Weakness typeCWE-200Sensitive information exposure

How to fix

Update

electron builder-util-runtime9.7.0 or later
electron electron-builder26.15.0 or later
builder-util-runtime9.7.0 or later

Affected products

Product	Affected versions	Fixed in
electron builder-util-runtime	v < 9.7.0	9.7.0
electron electron-builder	v < 26.15.0	26.15.0
builder-util-runtimenpm	v < 9.7.0	9.7.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.