How Information Disclosure via Unstripped Credential Headers Happens in Electron Apps and How to Fix It

Introduction

In the dsa-desktop Electron application, a high-severity vulnerability was discovered in the dependency chain through builder-util-runtime. The apps/dsa-desktop/package-lock.json file pinned builder-util-runtime at version 9.5.1 (with a nested dependency at 9.2.4), which contained a critical flaw in how HTTP redirects were handled during the auto-update process.

This vulnerability, tracked as CVE-2026-54673, could have allowed attackers to intercept authentication credentials by manipulating update server redirects. For any Electron desktop application using electron-updater, this represents a significant risk—the very mechanism designed to keep your application secure could become the vector for credential theft.

The Vulnerability Explained

What Happens During an Electron Update?

When an Electron application checks for updates, it makes HTTP requests to update servers. These requests often include authentication headers—tokens that verify the application is authorized to download updates. The builder-util-runtime package handles these HTTP communications for electron-updater.

The Dangerous Redirect Behavior

The vulnerable versions of builder-util-runtime (prior to 9.7.0) failed to strip sensitive headers when following HTTP redirects. Here's what the vulnerable dependency chain looked like in package-lock.json:

"node_modules/electron-updater/node_modules/builder-util-runtime": {
  "version": "9.5.1",
  "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.5.1.tgz",
  "integrity": "sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==",
  "license": "MIT",
  "dependencies": {
    "debug": "^4.3.4",
    "sax": "^1.2.4"
  }
}

Attack Scenario

Consider this attack flow specific to the dsa-desktop application:

1. Initial Request: The Electron app sends an update check to https://updates.legitimate-server.com/check with an Authorization: Bearer <token> header
2. Malicious Redirect: An attacker performs a man-in-the-middle attack or compromises the update server to return a 302 redirect to https://attacker-controlled-server.com/capture
3. Credential Leak: The vulnerable builder-util-runtime follows the redirect with the Authorization header intact
4. Token Theft: The attacker's server receives the valid authentication token

This is particularly dangerous because:
- Update mechanisms run with elevated privileges
- Users trust automatic updates
- The leaked tokens could provide access to private update channels or other authenticated resources

The Fix

Dependency Upgrade Strategy

The fix involves two key changes in the apps/dsa-desktop directory:

1. Removing the Nested Vulnerable Dependency

The entire vulnerable nested dependency block was removed from package-lock.json:

-    "node_modules/electron-updater/node_modules/builder-util-runtime": {
-      "version": "9.5.1",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.5.1.tgz",
-      "integrity": "sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "sax": "^1.2.4"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },

2. Upgrading the Root Dependency

The root builder-util-runtime was upgraded from 9.2.4 to 9.7.0:

     "node_modules/builder-util-runtime": {
-      "version": "9.2.4",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.2.4.tgz",
-      "integrity": "sha512-upp+biKpN/XZMLim7aguUyW8s0FUpDvOtK6sbanMFDAMBzpHDqdhgVYm6zc9HJ6nWo7u2Lxk60i2M6Jd3aiNrA==",
-      "dev": true,
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
+      "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
       "license": "MIT",

3. Adding an Override in package.json

To ensure all nested dependencies use the patched version, an override was added:

+  "overrides": {
+    "builder-util-runtime": "9.7.0"
+  }

Why This Works

The overrides field in package.json is a powerful npm feature that forces all instances of a dependency—regardless of where they appear in the dependency tree—to use the specified version. This ensures that even if electron-updater requests version 9.5.1, npm will resolve it to 9.7.0 instead.

Version 9.7.0 of builder-util-runtime properly implements header stripping during redirects, removing sensitive headers like Authorization, Cookie, and Proxy-Authorization before following redirects to different origins.

Key Takeaways

• Nested dependencies can hide vulnerabilities: The vulnerable builder-util-runtime@9.5.1 was nested under electron-updater, making it easy to miss in manual reviews
• npm overrides are essential for transitive dependency fixes: Without the "overrides" field in package.json, electron-updater would continue using the vulnerable version
• Auto-update mechanisms are high-value targets: Attackers specifically target update systems because they run with elevated privileges and user trust
• Header leakage during redirects is a common HTTP client flaw: Always verify that your HTTP client properly sanitizes headers when following cross-origin redirects
• The dsa-desktop application's update process is now protected: Users receiving updates will no longer risk credential exposure through redirect attacks

How Orbis AppSec Detected This

• Source: HTTP redirect response (3xx status code) from update server
• Sink: HTTP client request to redirect target URL in builder-util-runtime network handling code
• Missing control: Header sanitization logic to strip Authorization and other sensitive headers before following cross-origin redirects
• CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
• Fix: Upgraded builder-util-runtime from 9.5.1 to 9.7.0 via npm overrides, which implements proper header stripping during redirects

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-54673 demonstrates how a seemingly minor implementation detail—failing to strip headers during HTTP redirects—can create a significant security vulnerability. For Electron applications relying on auto-update functionality, this flaw could have exposed authentication credentials to malicious actors.

The fix was straightforward: upgrade builder-util-runtime to version 9.7.0 and use npm's override mechanism to ensure consistent versioning across the dependency tree. This pattern of using overrides for transitive dependency fixes is a valuable technique for any Node.js project.

Remember: your application's security is only as strong as its weakest dependency. Regular auditing, automated scanning, and prompt patching are essential practices for maintaining secure software.