Vulnerability-Lookup

GHSA-P2F4-R6V6-J797

Vulnerability from github – Published: 2026-07-24 14:03 – Updated: 2026-07-24 14:03

Summary

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Details

Summary

In electron-builder's builder-util-runtime package, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination.

Details

Root cause

HttpExecutor.prepareRedirectUrlOptions (introduced in builder-util-runtime via PR #9211, first released in v26.0.20) performed its cross-origin credential strip with a single case-sensitive property check:

// vulnerable code (electron-builder v26.0.20 – v26.14.x) [via builder-util-runtime <9.7.0]
if (headers?.authorization) {
  if (HttpExecutor.isCrossOriginRedirect(originalUrl, parsedRedirectUrl)) {
    delete headers.authorization   // only removes the exact key "authorization"
  }
}

JavaScript object property access is case-sensitive. The guard headers?.authorization evaluates to undefined (falsy) when the key is "Authorization", "AUTHORIZATION", or any other casing, so the branch is never entered and no header is deleted for those cases.

Affected updater flows

The clearest reproduced path is the private GitLab updater flow.

packages/electron-updater/src/providers/GitLabProvider.ts sets one of two credential headers depending on the token type:

// GitLabProvider.setAuthHeaderForToken (affected versions)
if (token.startsWith("Bearer")) {
  headers.authorization = token        // Bearer / OAuth token  →  key is lowercase
} else {
  headers["PRIVATE-TOKEN"] = token     // personal access token →  key is "PRIVATE-TOKEN"
}

During a private release update check, the updater requests a release asset through GitLab's direct_asset_url. GitLab commonly redirects asset downloads to an external object-storage origin (e.g., S3, GCS). Because the redirect crosses origins:

A personal access token in PRIVATE-TOKEN is never inspected by the vulnerable strip guard — it is forwarded intact.
A Bearer token set as headers.authorization (lowercase) is stripped correctly.
A Bearer token set as headers.Authorization (capital A) or any other mixed-case variant bypasses the guard and is forwarded intact.

GitLab is the concrete reproduced case; any other provider or custom updater configuration that places credentials in a non-lowercase-authorization header is equally affected.

Before v26.0.20

Versions prior to v26.0.20 did not contain prepareRedirectUrlOptions at all. All credential headers were forwarded unchanged on every redirect, regardless of origin. This represents a broader, pre-existing version of the same class of vulnerability.

Proof of concept (reproduction shape)

Configure the updater with an authenticated GitLab provider, supplying a personal access token (non-Bearer). The provider will set PRIVATE-TOKEN: <token> on requests.
Trigger an update check. The updater fetches release metadata and then requests a release asset URL.
The trusted GitLab origin returns a 3xx cross-origin redirect (e.g., to S3 object storage).
HttpExecutor.prepareRedirectUrlOptions is called. The guard headers?.authorization is falsy (the key is "PRIVATE-TOKEN"). No header is deleted.
The request to the redirect destination is issued with PRIVATE-TOKEN: <token> present in the headers.

Observed result: The personal access token is forwarded to the redirect destination. An attacker who controls or can observe the redirect destination receives the token.

Impact

This is a credential disclosure vulnerability. An automatic update check can leak:

GitLab personal access tokens (PRIVATE-TOKEN)
Bearer/OAuth tokens sent under a mixed-case Authorization key
Any other credential header not named exactly "authorization" in lowercase

Disclosure of a GitLab PAT grants the attacker whatever repository and API permissions the token carries, enabling unauthorized access to private source code, packages, or release artifacts.

Patches

Fixed in electron-builder v26.15.0 [included via v9.7.0 builder-util-runtime] via PR #9834 (commit 22a7532bd).

The incomplete property-access guard was replaced with a separator-agnostic, case-insensitive lookup against a registry of known sensitive header names:

// fixed code (v9.7.0+)
const normalizeName = (name: string): string =>
  name.toLowerCase().replace(/[-_]/g, "")

const SENSITIVE_REDIRECT_HEADERS = new Set([
  "authorization", "proxyauthorization", "privatetoken",
  "xapikey", "xauthtoken", "xaccesstoken", "xgitlabtoken",
  "cookie", "xcsrftoken",
])

// In prepareRedirectUrlOptions, on cross-origin redirect:
for (const key of Object.keys(headers)) {
  if (SENSITIVE_REDIRECT_HEADERS.has(normalizeName(key))) {
    delete (headers as Record<string, unknown>)[key]
  }
}

normalizeName converts to lowercase and strips - and _ separators, so PRIVATE-TOKEN, Private-Token, Authorization, AUTHORIZATION, X-Api-Key, etc. are all matched. The fix also exports addSensitiveRedirectHeader() to allow custom publishers to register additional headers.

Upgrade path: Update builder-util-runtime to >= 9.7.0.

Workarounds

There is no configuration-level workaround that prevents header forwarding in affected versions. The only mitigation short of upgrading is to avoid authenticated GitLab updater flows on versions < 9.7.0.

If operating in a network environment where you control all possible redirect destinations, you may be able to prevent the token from reaching an attacker-controlled host through network-layer controls, but this is not a reliable mitigation.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "builder-util-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54673"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T14:03:19Z",
    "nvd_published_at": "2026-06-30T23:17:28Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nIn `electron-builder`\u0027s `builder-util-runtime` package, the HTTP redirect handler (`HttpExecutor.prepareRedirectUrlOptions`) only stripped a credential header whose key string matched exactly lowercase `\"authorization\"`. Other credential-bearing headers \u2014 most notably `PRIVATE-TOKEN` (used by GitLab\u0027s personal access token flow) and mixed-case `Authorization` (used by GitLab\u0027s Bearer/OAuth flow) \u2014 were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination.\n\n---\n\n## Details\n\n### Root cause\n\n`HttpExecutor.prepareRedirectUrlOptions` (introduced in `builder-util-runtime` via [PR #9211](https://github.com/electron-userland/electron-builder/pull/9211), first released in `v26.0.20`) performed its cross-origin credential strip with a single case-sensitive property check:\n\n```typescript\n// vulnerable code (electron-builder v26.0.20 \u2013 v26.14.x) [via builder-util-runtime \u003c9.7.0]\nif (headers?.authorization) {\n  if (HttpExecutor.isCrossOriginRedirect(originalUrl, parsedRedirectUrl)) {\n    delete headers.authorization   // only removes the exact key \"authorization\"\n  }\n}\n```\n\nJavaScript object property access is case-sensitive. The guard `headers?.authorization` evaluates to `undefined` (falsy) when the key is `\"Authorization\"`, `\"AUTHORIZATION\"`, or any other casing, so the branch is never entered and **no header is deleted** for those cases.\n\n### Affected updater flows\n\nThe clearest reproduced path is the private GitLab updater flow.\n\n`packages/electron-updater/src/providers/GitLabProvider.ts` sets one of two credential headers depending on the token type:\n\n```typescript\n// GitLabProvider.setAuthHeaderForToken (affected versions)\nif (token.startsWith(\"Bearer\")) {\n  headers.authorization = token        // Bearer / OAuth token  \u2192  key is lowercase\n} else {\n  headers[\"PRIVATE-TOKEN\"] = token     // personal access token \u2192  key is \"PRIVATE-TOKEN\"\n}\n```\n\nDuring a private release update check, the updater requests a release asset through GitLab\u0027s `direct_asset_url`. GitLab commonly redirects asset downloads to an external object-storage origin (e.g., S3, GCS). Because the redirect crosses origins:\n\n1. A personal access token in `PRIVATE-TOKEN` **is never inspected** by the vulnerable strip guard \u2014 it is forwarded intact.\n2. A Bearer token set as `headers.authorization` (lowercase) **is stripped** correctly.\n3. A Bearer token set as `headers.Authorization` (capital A) or any other mixed-case variant **bypasses the guard** and is forwarded intact.\n\nGitLab is the concrete reproduced case; any other provider or custom updater configuration that places credentials in a non-lowercase-`authorization` header is equally affected.\n\n### Before v26.0.20\n\nVersions prior to `v26.0.20` did not contain `prepareRedirectUrlOptions` at all. All credential headers were forwarded unchanged on every redirect, regardless of origin. This represents a broader, pre-existing version of the same class of vulnerability.\n\n---\n\n## Proof of concept (reproduction shape)\n\n1. Configure the updater with an authenticated GitLab provider, supplying a personal access token (non-Bearer). The provider will set `PRIVATE-TOKEN: \u003ctoken\u003e` on requests.\n2. Trigger an update check. The updater fetches release metadata and then requests a release asset URL.\n3. The trusted GitLab origin returns a 3xx cross-origin redirect (e.g., to S3 object storage).\n4. `HttpExecutor.prepareRedirectUrlOptions` is called. The guard `headers?.authorization` is falsy (the key is `\"PRIVATE-TOKEN\"`). No header is deleted.\n5. The request to the redirect destination is issued with `PRIVATE-TOKEN: \u003ctoken\u003e` present in the headers.\n\n**Observed result:** The personal access token is forwarded to the redirect destination. An attacker who controls or can observe the redirect destination receives the token.\n\n---\n\n## Impact\n\nThis is a credential disclosure vulnerability. An automatic update check can leak:\n\n- GitLab personal access tokens (`PRIVATE-TOKEN`)\n- Bearer/OAuth tokens sent under a mixed-case `Authorization` key\n- Any other credential header not named exactly `\"authorization\"` in lowercase\n\nDisclosure of a GitLab PAT grants the attacker whatever repository and API permissions the token carries, enabling unauthorized access to private source code, packages, or release artifacts.\n\n---\n\n## Patches\n\nFixed in electron-builder `v26.15.0` [included via `v9.7.0` `builder-util-runtime`] via [PR #9834](https://github.com/electron-userland/electron-builder/pull/9834) (commit [`22a7532bd`](https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe)).\n\nThe incomplete property-access guard was replaced with a separator-agnostic, case-insensitive lookup against a registry of known sensitive header names:\n\n```typescript\n// fixed code (v9.7.0+)\nconst normalizeName = (name: string): string =\u003e\n  name.toLowerCase().replace(/[-_]/g, \"\")\n\nconst SENSITIVE_REDIRECT_HEADERS = new Set([\n  \"authorization\", \"proxyauthorization\", \"privatetoken\",\n  \"xapikey\", \"xauthtoken\", \"xaccesstoken\", \"xgitlabtoken\",\n  \"cookie\", \"xcsrftoken\",\n])\n\n// In prepareRedirectUrlOptions, on cross-origin redirect:\nfor (const key of Object.keys(headers)) {\n  if (SENSITIVE_REDIRECT_HEADERS.has(normalizeName(key))) {\n    delete (headers as Record\u003cstring, unknown\u003e)[key]\n  }\n}\n```\n\n`normalizeName` converts to lowercase and strips `-` and `_` separators, so `PRIVATE-TOKEN`, `Private-Token`, `Authorization`, `AUTHORIZATION`, `X-Api-Key`, etc. are all matched. The fix also exports `addSensitiveRedirectHeader()` to allow custom publishers to register additional headers.\n\n**Upgrade path:** Update `builder-util-runtime` to `\u003e= 9.7.0`.\n\n---\n\n## Workarounds\n\nThere is no configuration-level workaround that prevents header forwarding in affected versions. The only mitigation short of upgrading is to avoid authenticated GitLab updater flows on versions `\u003c 9.7.0`.\n\nIf operating in a network environment where you control all possible redirect destinations, you may be able to prevent the token from reaching an attacker-controlled host through network-layer controls, but this is not a reliable mitigation.",
  "id": "GHSA-p2f4-r6v6-j797",
  "modified": "2026-07-24T14:03:19Z",
  "published": "2026-07-24T14:03:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54673"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/pull/9834"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron-userland/electron-builder"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/releases/tag/electron-builder@26.15.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`"
}

CVE-2026-54673 (GCVE-0-2026-54673)

Vulnerability from cvelistv5 – Published: 2026-06-30 22:11 – Updated: 2026-07-01 13:26

Title

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Summary

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/electron-userland/electron-bui…	x_refsource_CONFIRM
https://github.com/electron-userland/electron-bui…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
electron-userland	electron-builder	Affected: < 26.15.0
electron-userland	builder-util-runtime	Affected: < 9.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54673",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T13:26:40.473989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-01T13:26:49.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron-builder",
          "vendor": "electron-userland",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.15.0"
            }
          ]
        },
        {
          "product": "builder-util-runtime",
          "vendor": "electron-userland",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase \"authorization\", exposing credentials. Other credential-bearing headers \u2014 most notably PRIVATE-TOKEN (used by GitLab\u0027s personal access token flow) and mixed-case Authorization (used by GitLab\u0027s Bearer/OAuth flow) \u2014 were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T22:12:18.294Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797"
        },
        {
          "name": "https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe"
        }
      ],
      "source": {
        "advisory": "GHSA-p2f4-r6v6-j797",
        "discovery": "UNKNOWN"
      },
      "title": "electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54673",
    "datePublished": "2026-06-30T22:11:37.587Z",
    "dateReserved": "2026-06-15T22:53:58.560Z",
    "dateUpdated": "2026-07-01T13:26:49.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-P2F4-R6V6-J797

Summary

Details

Root cause

Affected updater flows

Before v26.0.20

Proof of concept (reproduction shape)

Impact

Patches

Workarounds

CVE-2026-54673 (GCVE-0-2026-54673)

Tags

Sightings

Nomenclature