CVE-2024-27303

CVE-2024-27303 is a high-severity vulnerability affecting electron-builder versions prior to 24.13.2 on Windows. It allows an attacker to execute arbitrary code by placing a malicious cmd.exe in the same directory as the installer, which the NSIS installer script will then execute due to its search path behavior. The vulnerability has a CVSS score of 7.3, indicating a local attack vector with low complexity, requiring user interaction, and leading to high confidentiality, integrity, and availability impacts. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.