CVE-2026-54672

A flaw was found in electron-updater, a component used for automatic updates in Electron applications. This vulnerability arises because AppImage targets, built by app-builder-lib, incorrectly add the current working directory to the dynamic linker search path when setting the LD_LIBRARY_PATH environment variable. An attacker could exploit this by placing a malicious program in the same directory as an AppImage, which would then be executed when the AppImage is launched. This could allow the attacker to run arbitrary code on the affected system.

The vulnerability in electron-builder's AppImage packaging only affects applications distributed as AppImage format, where an empty LD_LIBRARY_PATH component causes the current working directory to be added to the dynamic linker search path. Red Hat products that bundle electron-builder components are not affected: the goose RPM is distributed as an RPM package (not AppImage), and Podman Desktop uses Flatpak and tar.gz targets on Linux (AppImage is not configured in its electron-builder config). The vulnerable AppImage code path is never exercised in any Red Hat product.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.