Critical Security Flaw in Flatpak-Builder: Host Code Execution Vulnerability
Summary
ALSA-2026:80973: Important: flatpak-builder security update. Affects flatpak-builder versions < 1.2.3-2.el8_10. Fixed in 1.2.3-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak-builder is a powerful tool designed for building flatpaks from source code. It simplifies the process of creating software packages that can run on various Linux distributions. This tool is essential for developers looking to distribute their applications in a consistent and secure manner. However, it has been found to have a significant security vulnerability that could allow unauthorized code execution.
Vulnerability Detail
The vulnerability arises from the execution of hooks during the patch source extraction process when using the 'git am' command. Specifically, if the 'use-git-am' option is enabled, malicious code can be executed on the host system, leading to potential unauthorized access and control. This vulnerability is identified as CVE-2026-86320 and poses a serious risk to systems utilizing flatpak-builder, especially in environments where untrusted sources are used.
How To Fix
Minimum fixed version
1.2.3-2.el8_10
This is the first release that contains the fix.
sudo dnf update flatpak-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the 'use-git-am' option in their flatpak-builder configurations to prevent the execution of potentially harmful hooks until the package is updated.
Conclusion
The flatpak-builder security vulnerability, identified as CVE-2026-86320, poses a significant risk of unauthorized code execution. It is essential for users to update to the patched version to safeguard their systems. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for flatpak-builder →
FAQ
CVE-2026-86320 is the identifier for a security vulnerability in flatpak-builder that allows host code execution through malicious hooks during patch source extraction.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Failing to address this vulnerability could lead to unauthorized code execution on your system, potentially compromising sensitive data and system integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider disabling the 'use-git-am' option as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak-builder.
