Critical Security Flaw in flatpak-builder: Host Code Execution Vulnerability
Summary
ALSA-2026:80495: Important: flatpak-builder security update. Affects flatpak-builder versions < 1.4.4-1.el10_2.1. Fixed in 1.4.4-1.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak-builder is a powerful tool designed for building flatpaks from source code. It simplifies the process of creating software packages that can run on various Linux distributions. However, it has been identified that a security vulnerability exists in the way flatpak-builder handles patch source extraction, specifically when using the 'git am' hook. This flaw can potentially allow malicious code execution on the host system.
Vulnerability Detail
The vulnerability, identified as CVE-2026-86320, arises from the execution of host code through the 'git am' hook during the patch source extraction process. If an attacker can manipulate the patch files, they could execute arbitrary code on the host system, leading to severe security risks such as unauthorized access and system compromise. This vulnerability is particularly concerning for systems that utilize flatpak-builder in automated build environments.
How To Fix
Minimum fixed version
1.4.4-1.el10_2.1
This is the first release that contains the fix.
sudo dnf update flatpak-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'use-git-am' option in flatpak-builder to prevent the execution of potentially harmful hooks until the package is updated. This can be done by modifying the build configuration to avoid using git am for patching.
Conclusion
In summary, the flatpak-builder package has a critical vulnerability that can lead to host code execution. It is crucial for users to update to the latest patched version to mitigate this risk. Additionally, temporary workarounds are available to reduce exposure until the update can be applied.
See every vulnerability recorded for flatpak-builder →
FAQ
Flatpak-builder is a tool used to create flatpak packages from source code, allowing developers to distribute applications across various Linux distributions.
CVE-2026-86320 refers to a specific security vulnerability in flatpak-builder that allows for host code execution through malicious patch files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized code execution on the host system, which could lead to data breaches, system compromise, and other malicious activities.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak-builder.
