electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)

Vulnerability

Overview

A vulnerability in electron-builder versions prior to 24.13.2 affects the NSIS installer on Windows. The installer uses the NSExec plugin to execute cmd.exe via the .nsh installer script. By default, NSExec searches the current directory (where the installer is located) before searching the system PATH. This allows an attacker to place a malicious executable named cmd.exe in the same folder as the installer, causing the installer to run the attacker-controlled file instead of the legitimate system command. The root cause is a failure to specify the full absolute path to cmd.exe, leading to an untrusted search path (CWE-426). [1][4]

Exploitation

Conditions

Exploitation requires the attacker to have a means of placing a malicious cmd.exe in the same directory as the installer before it is executed. This could occur if an attacker distributes a trojanized installer or if a user extracts an installer archive into a directory where an attacker has write access. No authentication or elevated privileges are needed from the attacker, but the user must be tricked into running the installer from a compromised location. The vulnerability is Windows-specific and does not affect macOS or Linux builds. [1]

Impact and

Mitigation

If exploited, the attacker achieves arbitrary code execution at the installer privilege level, which typically runs with the current user's permissions. This could lead to full compromise of the user's session or installation of malware. The code executes before the application is present, making pre-install checks impossible. The fix in version 24.13.2 replaces relative cmd calls with absolute paths using %SYSTEMROOT%\System32\cmd.exe, preventing the directory search order attack. No workaround exists; users must update to the patched version. [1][3]