GHSA-7g7r-gx96-252g: Arbitrary Code Execution via LD_LIBRARY_PATH in electron-builder AppImage (CVE-2026-54672)

Vulnerability Overview Vulnerability Name: Uncontrolled search path elements within built by Vulnerability ID: GHSA-7g7r-gx96-252g Severity: High (7.8 / 10) CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2026-54672 Weakness: CWE-427 Description Summary When setting the environment variable, AppImages built with may include empty path components. This causes the current working directory to be added to the dynamic linker's search path, allowing an attacker to execute arbitrary code by placing malicious shared libraries in the directory from which the AppImage is launched. This vulnerability is the same as CVE-2024-41827. Details The vulnerability exists in two separate code paths within (Toolkit 1.9.8) and the upstream dependency (Toolkit 8.0.8). Path 1 — Modern Static Runtime (TypeScript-generated AppRun) The AppRun script generated by contains the following line: When is not set at startup, it evaluates to: The trailing is interpreted by the dynamic linker as an empty path component, resolving to the current working directory. If an attacker can place a malicious shared library (e.g., ) in the directory where the AppImage is executed, that library will supersede legitimate library loading, leading to arbitrary code execution. The same issue affects the same scripts for , , and . Path 2 — Legacy FUSE2 Toolchain (app-builder-bin) AppImages built using the legacy FUSE2 toolchain (Toolkit appimage < 8.0.8) delegate to the Go binary to generate the AppRun script, which contains the same vulnerable template: https://github.com/develar/app-builder/blob/70d492595d8f034c68d7e762b3aa7583d6b0e9a/pkg/package-forms/appimage/templates/AppRun.sh#L27 Impact An attacker capable of writing files to the executable directory of a vulnerable AppImage can cause arbitrary shared libraries to be loaded during execution, resulting in arbitrary code execution with the permissions of the user running the AppImage. Affected Versions This vulnerability was fully fixed in (commit 01bab078, PR #6829), where all AppImage builds migrated to the TypeScript implementation as was completely removed from the dependency tree. Mitigations Before launching the AppImage, set to a non-empty value so that the concatenation does not produce an empty path component. Alternatively, avoid running AppImage files from writable directories such as .

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-7g7r-gx96-252g: Arbitrary Code Execution via LD_LIBRARY_PATH in electron-builder AppImage (CVE-2026-54672)

More from this source