CVE-2026-54673

The CVE affects electron-updater (builder-util-runtime component) prior to version 9.7.0. The root cause is that HttpExecutor.prepareRedirectUrlOptions only stripped a credential header named exactly the lowercase string “authorization.” Other credential-bearing headers, notably PRIVATE-TOKEN and...

CVE-2026-54673

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers —...

CVE-2026-54673 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers —...

PT-2026-54077

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An inappropriate implementation in the Updater component on Windows allows a local attacker to achieve OS-level privilege escalation by using a malicious file. Recommendations Update...

CVE-2026-13800: Improper Access Control

Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...

CVE-2026-14113: Use After Free

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

PT-2026-54019

Name of the Vulnerable Software and Affected Versions electron-updater versions prior to 9.7.0 Description The HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only removes credential headers that exactly match the lowercase string "authorization". Consequently, other credential-beari...

CVE-2026-13827: Use After Free

Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. Chromium security severity: High...

PT-2026-54294

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Updater component on Windows. This flaw allows a local attacker to achieve OS-level privilege escalation by utilizing a malicious file. Use after fr...

PT-2026-54121

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Updater component on Windows. This flaw allows a local attacker to achieve OS-level privilege escalation by utilizing a malicious file. Use after fr...

CVE-2026-54672: Uncontrolled Search Path Element

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linke...

PT-2026-54104

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Updater component of Google Chrome on Mac. This flaw allows a local attacker to achieve privilege escalation by utilizing a malicious file. Use afte...

PT-2026-54388

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue exists in the Updater component on Windows. This flaw allows a remote attacker who has already compromised the renderer process to potentially achieve a sandbox...

PT-2026-54018

Name of the Vulnerable Software and Affected Versions electron-updater versions prior to 26.15.0 Description AppImage targets built by app-builder-lib can use an empty path component when setting the LD LIBRARY PATH environment variable at runtime. This behavior causes the current working directo...

CVE-2026-54673: Exposure of Sensitive Information to an Unauthorized Actor

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers —...

CVE-2026-13844: Use After Free

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...

CVE-2026-14018: Use After Free

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Medium...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: nerdctl, kubescape-server, flux-source-controller, argo-workflows-fips, frankenphp-8.3, elastic-agent-fips, cloudbeat-fips, helm, fscrypt, gitlab-kas, k9s, knative-serving-fips, prometheus, trivy-operator-fips, kyverno-fips, cert-manager, coder-fips, kaf, telegraf,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: nerdctl, kubescape-server, flux-source-controller, argo-workflows-fips, frankenphp-8.3, elastic-agent-fips, cloudbeat-fips, helm, fscrypt, gitlab-kas, k9s, knative-serving-fips, prometheus, trivy-operator-fips, kyverno-fips, cert-manager, coder-fips, kaf, telegraf,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: syft, nerdctl, kubescape-server, atlantis-fips, crossplane-provider-azure-policyinsights, mods, crossplane-provider-azure-operationsmanagement, argo-workflows-fips, crossplane-provider-azure-storagesync, flux-source-controller, frankenphp-8.3,...