Security vulnerabilities and automated fixes for electron updater issues
2 posts found
CVE-2026-54673 is a high-severity information disclosure vulnerability in `electron-updater` (via `builder-util-runtime`) where credential headers are not stripped before following HTTP redirects, potentially exposing authentication tokens to unintended servers. The vulnerability was present in `builder-util-runtime@9.5.1` and was resolved by upgrading to `9.7.0`. This fix is critical for any Electron application that uses auto-update functionality against endpoints that may issue redirects.
A critical vulnerability in electron-updater (CVE-2026-54673) allowed OAuth tokens and API credentials to leak when HTTP redirects occurred during application updates. The fix upgrades electron-updater from version 6.3.0 to 6.8.9, which properly strips sensitive authorization headers before following redirects to external domains.