178 matches found
CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite
A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...
CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite
A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...
CVE-2026-54673
creationtimestamp| type| source ---|---|--- 2026-07-24 16:35:24+00:00| published-proof-of-concept| https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797...
GHSA-P2F4-R6V6-J797 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.1-alpha.0, <=0.0.10) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)
app-builder-lib NPM version =26.0.0-alpha.0, =0.0.1-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: OSV:GHSA-7G7R-GX96-252G...
@depup/electron-builder (26.8.1-depup.0), @lynx-js/lynxtron-builder (>=0.0.1-alpha.0, <=0.0.10) +8 more potentially affected by CVE-2026-54672 via app-builder-lib (>=26.0.0-alpha.0, <=26.14.0)
app-builder-lib NPM version =26.0.0-alpha.0, =0.0.1-alpha.0, =26.8.2-beta.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.0.0-alpha.0, =26.14.0 Source cves: CVE-2026-54672 Source advisory: SNYK:JS-APPBUILDERLIB-17744441...
@acceleratxr/electron-shared (>=1.9.0, <=1.19.0), @adamklein/situp (>=1.0.4, <=1.0.5) +204 more potentially affected by CVE-2026-54673 via builder-util-runtime (>=9.0.0, <=9.6.3)
builder-util-runtime NPM version =9.0.0, =1.9.0, =1.0.4, =26.0.11-2, =6.6.2-2, =0.1.0, =0.0.228, =0.0.1, =1.0.6, =0.0.1-beta.5, =0.0.3, =0.0.24, =0.0.50, =0.39.0, =1.17.0 and more Source cves: CVE-2026-54673 Source advisory: SNYK:JS-BUILDERUTILRUNTIME-17744440...
Malicious code in @403name/electron-buidler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed72e6dbbdb78cd8fc99bfafc15900f16543690460ae2cfad826aeee20c05a4 On require, index.js executes an immediately-invoked function that platform-gates to macOS, skips CI environments, drops a one-shot marker file in...
EUVD-2025-176070
Malicious code in taphonomy-neuromorphic-cressida-electron-builder npm...
Malicious code in stratigraphy-helios-janus-electron-builder (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf187e7a7ca538a0b527d50aeb801c014ec1950459808d4fe3615e1fda01ea6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179183
Malicious code in electron-builder-kaus-non-blocking-europa npm...
EUVD-2025-179750
Malicious code in charon-transhumanism-zephyr-electron-builder npm...
EUVD-2025-180162
Malicious code in babel-electron-builder-hexo-nightmare npm...
Malicious code in electron-builder-kaus-non-blocking-europa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc97f9ddff3d836878325e761ded0213655d4240acbfa676ac68ebd722f29c61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180188
Malicious code in await-husky-electron-builder-superagent npm...
MAL-2025-187730 Malicious code in leda-electron-builder-chromedriver-nodemon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c9799029874852e5e9eb516a15d919a84f36ac43653e1671cfaaa75560b7926 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176246
Malicious code in spinner-spectron-electron-builder-loglevel npm...
EUVD-2025-179184
Malicious code in electron-builder-csv-npm-asteroid npm...