CVE-2026-86320
Description
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2026-86320 NameCVE-2026-86320 SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Debian Bugs1147700 Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus flatpak-builder (PTS)bookworm1.2.3-1vulnerable…
CVE-2026-86320
| Name | CVE-2026-86320 |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1147700 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| flatpak-builder (PTS) | bookworm | 1.2.3-1 | vulnerable |
| trixie | 1.4.4-2 | vulnerable | |
| forky | 1.4.10-1 | vulnerable | |
| sid | 1.4.11-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| flatpak-builder | source | (unstable) | 1.4.11-1 | 1147700 |
Notes
[trixie] - flatpak-builder <no-dsa> (Minor issue)
[bookworm] - flatpak-builder <postponed> (Minor issue)
https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv
Apply commands
[trixie] - flatpak-builder <no-dsa> (Minor issue)[bookworm] - flatpak-builder <postponed> (Minor issue)https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xvOS impact
Debian Mixed 4 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Affected | — |
| sid | Fixed | 1.4.11-1 |
| forky | Fixed | 1.4.11-1 |
| bookworm | Affected | — |
Alpine Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| v3.24 | Fixed | 1.4.11-r0 |
References
- https://security-tracker.debian.org/tracker/CVE-2026-86320
- https://security.alpinelinux.org/vuln/CVE-2026-86320
- https://pkgs.alpinelinux.org/packages?name=flatpak-builder
- https://access.redhat.com/security/cve/CVE-2026-86320
- https://bugzilla.redhat.com/show_bug.cgi?id=2471023
- https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv
CWEs
CWE-94
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.