Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
AppImage targets built by app-builder-lib could use an empty path component when setting the LDLIBRARYPATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This vulnerability is the same class as CVE-2024-41817. Details The vulnerability existed in two independent code paths within app-builder-lib (toolset 1.0.0) and through upstream dependency app-builder-bin (toolset 0.0.0). Path 1 — Modern static runtime (AppRun generated by TypeScript) The AppRun script generated by app-builder-lib contained this line: When LDLIBRARYPATH is not set in the environment at launch time, this evaluates to: The trailing : is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared…
Recommended action: Upgrade to 26.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Windows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Patches Fixed in https://github.com/electron-userland/electron-builder/pull/8059 Workarounds None, it executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer. References https://cwe.mitre.org/data/definitions/426.html https://cwe.mitre.org/data/definitions/427
Recommended action: Upgrade to 24.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.