Introduction
In the dsa-desktop Electron application, a high-severity vulnerability was discovered in the dependency chain through builder-util-runtime. The apps/dsa-desktop/package-lock.json file pinned builder-util-runtime at version 9.5.1 (with a nested dependency at 9.2.4), which contained a critical flaw in how HTTP redirects were handled during the auto-update process.
This vulnerability, tracked as CVE-2026-54673, could have allowed attackers to intercept authentication credentials by manipulating update server redirects. For any Electron desktop application using electron-updater, this represents a significant risk—the very mechanism designed to keep your application secure could become the vector for credential theft.
The Vulnerability Explained
What Happens During an Electron Update?
When an Electron application checks for updates, it makes HTTP requests to update servers. These requests often include authentication headers—tokens that verify the application is authorized to download updates. The builder-util-runtime package handles these HTTP communications for electron-updater.
The Dangerous Redirect Behavior
The vulnerable versions of builder-util-runtime (prior to 9.7.0) failed to strip sensitive headers when following HTTP redirects. Here's what the vulnerable dependency chain looked like in package-lock.json:
"node_modules/electron-updater/node_modules/builder-util-runtime": {
"version": "9.5.1",
"resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.5.1.tgz",
"integrity": "sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==",
"license": "MIT",
"dependencies": {
"debug": "^4.3.4",
"sax": "^1.2.4"
}
}
Attack Scenario
Consider this attack flow specific to the dsa-desktop application:
- Initial Request: The Electron app sends an update check to
https://updates.legitimate-server.com/checkwith anAuthorization: Bearer <token>header - Malicious Redirect: An attacker performs a man-in-the-middle attack or compromises the update server to return a 302 redirect to
https://attacker-controlled-server.com/capture - Credential Leak: The vulnerable
builder-util-runtimefollows the redirect with the Authorization header intact - Token Theft: The attacker's server receives the valid authentication token
This is particularly dangerous because:
- Update mechanisms run with elevated privileges
- Users trust automatic updates
- The leaked tokens could provide access to private update channels or other authenticated resources
The Fix
Dependency Upgrade Strategy
The fix involves two key changes in the apps/dsa-desktop directory:
1. Removing the Nested Vulnerable Dependency
The entire vulnerable nested dependency block was removed from package-lock.json:
- "node_modules/electron-updater/node_modules/builder-util-runtime": {
- "version": "9.5.1",
- "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.5.1.tgz",
- "integrity": "sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==",
- "license": "MIT",
- "dependencies": {
- "debug": "^4.3.4",
- "sax": "^1.2.4"
- },
- "engines": {
- "node": ">=12.0.0"
- }
- },
2. Upgrading the Root Dependency
The root builder-util-runtime was upgraded from 9.2.4 to 9.7.0:
"node_modules/builder-util-runtime": {
- "version": "9.2.4",
- "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.4.tgz",
- "integrity": "sha512-upp+biKpN/XZMLim7aguUyW8s0FUpDvOtK6sbanMFDAMBzpHDqdhgVYm6zc9HJ6nWo7u2Lxk60i2M6Jd3aiNrA==",
- "dev": true,
+ "version": "9.7.0",
+ "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
+ "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
"license": "MIT",
3. Adding an Override in package.json
To ensure all nested dependencies use the patched version, an override was added:
+ "overrides": {
+ "builder-util-runtime": "9.7.0"
+ }
Why This Works
The overrides field in package.json is a powerful npm feature that forces all instances of a dependency—regardless of where they appear in the dependency tree—to use the specified version. This ensures that even if electron-updater requests version 9.5.1, npm will resolve it to 9.7.0 instead.
Version 9.7.0 of builder-util-runtime properly implements header stripping during redirects, removing sensitive headers like Authorization, Cookie, and Proxy-Authorization before following redirects to different origins.
Prevention & Best Practices
1. Regular Dependency Auditing
Run security audits regularly:
npm audit
# or
npx trivy fs --scanners vuln ./
2. Use Dependency Override Patterns
When a vulnerability exists in a transitive dependency, use overrides to force the patched version:
{
"overrides": {
"vulnerable-package": "^patched.version"
}
}
3. Pin Critical Security Dependencies
For security-critical packages like those handling HTTP communications, consider pinning exact versions and reviewing changelogs before updates.
4. Implement Defense in Depth
Even with patched dependencies:
- Use short-lived tokens where possible
- Implement token rotation
- Monitor for unusual update server behavior
- Consider certificate pinning for update endpoints
5. Enable Dependabot or Similar Tools
Automated dependency update tools can catch these vulnerabilities early, often before they're widely exploited.
Key Takeaways
- Nested dependencies can hide vulnerabilities: The vulnerable
builder-util-runtime@9.5.1was nested underelectron-updater, making it easy to miss in manual reviews - npm overrides are essential for transitive dependency fixes: Without the
"overrides"field inpackage.json, electron-updater would continue using the vulnerable version - Auto-update mechanisms are high-value targets: Attackers specifically target update systems because they run with elevated privileges and user trust
- Header leakage during redirects is a common HTTP client flaw: Always verify that your HTTP client properly sanitizes headers when following cross-origin redirects
- The
dsa-desktopapplication's update process is now protected: Users receiving updates will no longer risk credential exposure through redirect attacks
How Orbis AppSec Detected This
- Source: HTTP redirect response (3xx status code) from update server
- Sink: HTTP client request to redirect target URL in
builder-util-runtimenetwork handling code - Missing control: Header sanitization logic to strip
Authorizationand other sensitive headers before following cross-origin redirects - CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- Fix: Upgraded
builder-util-runtimefrom 9.5.1 to 9.7.0 via npm overrides, which implements proper header stripping during redirects
Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.
Conclusion
CVE-2026-54673 demonstrates how a seemingly minor implementation detail—failing to strip headers during HTTP redirects—can create a significant security vulnerability. For Electron applications relying on auto-update functionality, this flaw could have exposed authentication credentials to malicious actors.
The fix was straightforward: upgrade builder-util-runtime to version 9.7.0 and use npm's override mechanism to ensure consistent versioning across the dependency tree. This pattern of using overrides for transitive dependency fixes is a valuable technique for any Node.js project.
Remember: your application's security is only as strong as its weakest dependency. Regular auditing, automated scanning, and prompt patching are essential practices for maintaining secure software.