Critical Security Flaw in flatpak-builder: Host Code Execution Risk
Summary
ALSA-2026:80496: Important: flatpak-builder security update. Affects flatpak-builder versions < 1.2.3-1.el9_8.1. Fixed in 1.2.3-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak-builder is a powerful tool designed for building flatpaks from source code. It simplifies the process of creating software packages that can run on various Linux distributions. However, it has been identified that a vulnerability exists within its functionality, specifically related to the execution of hooks during patch source extraction. This flaw can potentially allow malicious code execution on the host system.
Vulnerability Detail
The vulnerability arises from the git am hook execution in the patch source extraction process when the use-git-am option is enabled. This flaw (CVE-2026-86320) can be exploited by an attacker to execute arbitrary code on the host system, leading to severe security implications such as unauthorized access and data breaches. The risk is particularly high if untrusted sources are used for building flatpaks, as they could contain malicious patches.
How To Fix
Minimum fixed version
1.2.3-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update flatpak-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the use-git-am option when extracting patches from sources until the package is updated. This will help prevent the execution of potentially harmful code.
Conclusion
The identified vulnerability in flatpak-builder poses a significant risk of host code execution, necessitating immediate attention. Users are advised to update to the latest version to mitigate potential threats. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for flatpak-builder →
FAQ
CVE-2026-86320 is the identifier for the vulnerability in flatpak-builder that allows host code execution via git am hook execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not addressing this vulnerability can lead to unauthorized code execution, potentially compromising the security of your system and data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, refrain from using the use-git-am option in flatpak-builder to minimize risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak-builder.
