184 matches found
CVE-2026-13723
A flaw was found in electron-builder. An attacker can exploit a Unicode Normalization Collision, combined with symlink following behavior, within the zipx.Unzip extraction routine. By crafting a malicious ZIP archive, the attacker can cause the application to treat certain Unicode equivalent...
CVE-2026-82649
SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...
CVE-2026-82649 SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...
CVE-2026-82649 SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path
SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...
CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite
A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...
CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite
A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...
CVE-2026-54673
creationtimestamp| type| source ---|---|--- 2026-07-24 16:35:24+00:00| published-proof-of-concept| https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797 2026-10-07 14:08:44+00:00| published-proof-of-concept| https://t.me/bdufstecru/3507...
GHSA-P2F4-R6V6-J797 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.0-alpha.0, <=0.0.30) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)
app-builder-lib NPM version =26.0.0-alpha.0, =0.0.0-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: GHSA-7G7R-GX96-252G...
@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.0-alpha.0, <=0.0.30) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)
app-builder-lib NPM version =26.0.0-alpha.0, =0.0.0-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: OSV:GHSA-7G7R-GX96-252G...
@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.0-alpha.0, <=0.0.30) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)
app-builder-lib NPM version =26.0.0-alpha.0, =0.0.0-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: SNYK:JS-APPBUILDERLIB-17744441...
Malicious code in @403name/electron-buidler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed72e6dbbdb78cd8fc99bfafc15900f16543690460ae2cfad826aeee20c05a4 On require, index.js executes an immediately-invoked function that platform-gates to macOS, skips CI environments, drops a one-shot marker file in...
EUVD-2025-179566
Malicious code in cors-centaurus-electron-builder-galaxy npm...
EUVD-2025-178152
Malicious code in leda-electron-builder-chromedriver-nodemon npm...
EUVD-2025-179197
Malicious code in eigenstate-electron-builder-despina-bionics npm...
Malicious code in electron-builder-kaus-non-blocking-europa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc97f9ddff3d836878325e761ded0213655d4240acbfa676ac68ebd722f29c61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177939
Malicious code in materialize-framework-electron-builder-enceladus npm...
EUVD-2025-179183
Malicious code in electron-builder-kaus-non-blocking-europa npm...