https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:07:58 +0000 https://cve.radiocsirt.org/vuln/cve-2026-54673 <p><strong>Affected:</strong> electron-userland electron-builder, electron-userland builder-util-runtime</p> <p>electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase &#34;authorization&#34;, exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab&#39;s personal access token flow) and mixed-case Authorization (used by GitLab&#39;s Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.</p> <p><strong>Affected:</strong> electron-userland electron-builder, electron-userland builder-util-runtime</p> <p>electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase &#34;authorization&#34;, exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab&#39;s personal access token flow) and mixed-case Authorization (used by GitLab&#39;s Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-54673