builder-util-runtime Electron Unauthorized Access

The vulnerability of the builder-util-runtime module of the Electron-updater software platform for creating Electron applications is related to information disclosure. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

@acceleratxr/electron-shared (>=1.9.0, <=1.19.0), @adamklein/situp (>=1.0.4, <=1.0.5) +209 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=9.0.0-alpha.0, <=9.6.3)

builder-util-runtime NPM version =9.0.0-alpha.0, =1.9.0, =1.0.4, =26.0.11-2, =6.6.2-2, =0.1.0, =0.0.228, =0.0.1, =1.0.6, =0.0.1-beta.5, =0.0.3, =0.0.24, =0.0.50, =0.39.0, =1.17.0 and more Source cves: CVE-2026-54673 Source advisory: OSV:GHSA-P2F4-R6V6-J797...

@acceleratxr/electron-shared (>=1.9.0, <=1.19.0), @adamklein/situp (>=1.0.4, <=1.0.5) +209 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=9.0.0-alpha.0, <=9.6.3)

builder-util-runtime NPM version =9.0.0-alpha.0, =1.9.0, =1.0.4, =26.0.11-2, =6.6.2-2, =0.1.0, =0.0.228, =0.0.1, =1.0.6, =0.0.1-beta.5, =0.0.3, =0.0.24, =0.0.50, =0.39.0, =1.17.0 and more Source cves: CVE-2026-54673 Source advisory: GHSA-P2F4-R6V6-J797...

GHSA-P2F4-R6V6-J797 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...

NPM: electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

NPM: electron-updater: Cross-origin redirect leaks PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtime vulnerability discovered by ? in WordPress Npm builder-util-runtime versions 9.7.0...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpExecutor.prepareRedirectUrlOptions process. An attacker can obtain sensitive credentials, such as GitLab's PRIVATE-TOKEN or mixed-case Authorization headers, by leveraging a...

@acceleratxr/electron-shared (>=1.9.0, <=1.19.0), @adamklein/situp (>=1.0.4, <=1.0.5) +209 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=9.0.0-alpha.0, <=9.6.3)

builder-util-runtime NPM version =9.0.0-alpha.0, =1.9.0, =1.0.4, =26.0.11-2, =6.6.2-2, =0.1.0, =0.0.228, =0.0.1, =1.0.6, =0.0.1-beta.5, =0.0.3, =0.0.24, =0.0.50, =0.39.0, =1.17.0 and more Source cves: CVE-2026-54673 Source advisory: SNYK:JS-BUILDERUTILRUNTIME-17744440...

0.edsql.electronapp (1.0.65), @abcum/electron-updater (>=0.1.0, <=0.1.2) +610 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=0.0.0-semantic-release, <=9.6.3)

builder-util-runtime NPM version =0.0.0-semantic-release, =0.1.0, =0.1.0, =3.0.5, =0.1.0, =1.9.0, =1.1.0, =22.6.1-1, =1.0.4, =1.0.0, =0.0.10, =0.0.1, =26.0.11-2, =6.6.2-2, =0.0.1, =1.0.3 and more Source cves: CVE-2026-54673 Source advisory: MEND:CVE-2026-54673...