Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| app-builder-lib | npm | < 26.15.0 | 26.15.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the generation of the AppRun shell script for AppImage packages. Specifically, it involves the insecure construction of the LD_LIBRARY_PATH environment variable. The vulnerable code concatenates a new path with the existing LD_LIBRARY_PATH using a colon, like export LD_LIBRARY_PATH="/new/path:${LD_LIBRARY_PATH}". If LD_LIBRARY_PATH is not set when the AppImage is launched, this results in a trailing colon (e.g., /new/path:), which causes the dynamic linker to add the current working directory to its search path. This allows for arbitrary code execution if a malicious shared library is placed in the same directory from which the AppImage is run.
The vulnerability existed in two code paths:
app-builder-lib.app-builder-bin, which was used for legacy builds.The provided security patch, commit 01b8ba979d1db44543e18d07b4ad94953deb10ea, resolves the vulnerability by completely removing the legacy app-builder-bin dependency and migrating all build logic to a pure TypeScript implementation. While the commit is extensive, it does not contain the specific file (packages/app-builder-lib/src/targets/AppImageTarget.ts) where the vulnerable script generation logic resided. The fix was applied in a prior commit (a33464c), which corrected the template string to use shell parameter expansion (${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}) to conditionally add the colon only if the variable is already set and non-empty. Because the provided commit only contains the final removal of the legacy path and not the direct fix to the vulnerable function, no vulnerable functions can be identified from the patch evidence.