https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:40:37.493766+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331689 EUVD-2026-331689 2026-10-05T19:40:37.568722+00:00 EUVD-2026-331689 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54672 fkie_cve-2026-54672 2026-10-05T19:40:37.568795+00:00

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched. This issue has been fixed in version 26.15.0.

 https://cve.radiocsirt.org/vuln/ghsa-7g7r-gx96-252g GHSA-7g7r-gx96-252g — electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` 2026-10-05T19:40:37.568862+00:00

Affected: npm: app-builder-lib

### Summary

`AppImage` targets built by `app-builder-lib` could use an empty path component when setting the `LD_LIBRARY_PATH` environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the `AppImage` is launched.

This vulnerability is the same class as [`CVE-2024-41817`](https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8rxc-922v-phg8).

### Details

The vulnerability existed in two independent code paths within `app-builder-lib` (toolset `1.0.0`) and through upstream dependency `app-builder-bin` (toolset `0.0.0`).

#### Path 1 — Modern static runtime (`AppRun` generated by TypeScript)

The `AppRun` script generated by `app-builder-lib` contained this line:

```bash export LD_LIBRARY_PATH="${APPDIR}/usr/lib:${LD_LIBRARY_PATH}" ```

When `LD_LIBRARY_PATH` is not set in the environment at launch time, this evaluates to:

``` /path/to/app.AppDir/usr/lib: ```

The trailing `:` is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared library (e.g., `libfoo.so`) in the directory from which the `AppImage` is executed, that library will be loaded in place of the legitimate one, resulting in arbitrary code execution.

The same issue affected `PATH`, `XDG_DATA_DIRS`, and `GSETTINGS_SCHEMA_…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11200-1 openSUSE-SU-2026:11200-1 — heroic-games-launcher-2.22.0-4.1 on GA media 2026-10-05T19:40:37.568977+00:00

heroic-games-launcher-2.22.0-4.1 on GA media