Security vulnerabilities and automated fixes for builder util runtime issues
1 post found
CVE-2026-54673 is a high-severity information disclosure vulnerability in `electron-updater` (via `builder-util-runtime`) where credential headers are not stripped before following HTTP redirects, potentially exposing authentication tokens to unintended servers. The vulnerability was present in `builder-util-runtime@9.5.1` and was resolved by upgrading to `9.7.0`. This fix is critical for any Electron application that uses auto-update functionality against endpoints that may issue redirects.