Builder Util Runtime
Approved changes feed: RSS · Atom
cpe:2.3:a:electron-userland:builder-util-runtime:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Electron Userland (eb243a27-7ff4-5f5e-96fd-463f7571f022) |
|---|---|
| Product | Builder Util Runtime (b480cc55-3465-51ae-85cc-b3eb0da79905) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54673 |
vulnerable | 2026-07-29 01:00:27.920456 |
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.
Published: 2026-06-30T22:11:37.587Z
Updated: 2026-07-01T13:26:49.397Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.