Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-54672 high CVSS 7.8

Vulnerability in app-builder-lib (CVE-2026-54672)

Summary

Vulnerability in app-builder-lib (CVE-2026-54672). Successful exploitation can lead to full system takeover. Exploitable via AppImage. Mitigation: upgrade to 26.15.0 or later.

Original description

The description as published by the source.

Summary

AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.

This vulnerability is the same class as CVE-2024-41817.

Details

The vulnerability existed in two independent code paths within app-builder-lib (toolset 1.0.0) and through upstream dependency app-builder-bin (toolset 0.0.0).

Path 1 — Modern static runtime (AppRun generated by TypeScript)

The AppRun script generated by app-builder-lib contained this line:

export LD_LIBRARY_PATH="${APPDIR}/usr/lib:${LD_LIBRARY_PATH}"

When LD_LIBRARY_PATH is not set in the environment at launch time, this evaluates to:

/path/to/app.AppDir/usr/lib:

The trailing : is treated by the dynamic linker as an empty path component, which resolves to the current working directory. If an attacker can place a malicious shared library (e.g., libfoo.so) in the directory from which the AppImage is executed, that library will be loaded in place of the legitimate one, resulting in arbitrary code execution.

The same issue affected PATH, XDG_DATA_DIRS, and `GSETTINGS_SCHEMA_D…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-54672 has been found in app-builder-lib.
Attackers can target a specific entry point like AppImage over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 7.8/10.
What to do: upgrade app-builder-lib to 26.15.0 or later.
If unsure, ask your IT team or search "app-builder-lib CVE-2026-54672" on the vendor's site.

CVE-2026-54672 (app-builder-lib) — CWE-427 / CVSS v3 7.8
Attack vector: local / no user interaction
Attack surface: AppImage / LD_LIBRARY_PATH / AppRun / libfoo.so
Patched: 26.15.0 — apply immediately
Workaround: Set LD_LIBRARY_PATH to a non-empty value before launching the AppImage, so that the concatenation does not produce an empty path component.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-427) exists in app-builder-lib. Attackers reach the vulnerable code path via AppImage.

📍 Affected scope

Check the vendor advisory for the affected versions of app-builder-lib. Attack surface: AppImage / LD_LIBRARY_PATH / AppRun / libfoo.so.

🔥 Severity

Severity: High (CVSS 7.8/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 26.15.0.

🛡️ Workaround

Workaround: Set LD_LIBRARY_PATH to a non-empty value before launching the AppImage, so that the concatenation does not produce an empty path component.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'app-builder-lib' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'app-builder-lib' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で app-builder-lib を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Set `LD_LIBRARY_PATH` to a non-empty value before launching the `AppImage`, so that the concatenation does not produce an empty path component.

    パッチが適用されるまでの応急処置として、Set LD_LIBRARY_PATH to a non-empty value before launching the AppImage, so that the concatenation does not produce an empty path component. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade app-builder-lib to 26.15.0

    ステージング環境で 26.15.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm app-builder-lib
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"26.15.0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details