CVE-2026-86320: Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

AIONLYREPORT package: flatpak-builder-1.4.4-1.el10 ------ Summary: Host code execution via git am hook execution in patch source extraction (use-git-am): a crafted manifest can plant a Git hook in the shared extraction directory and have git am execute it in the host build context during patch application, before application sandboxing applies. Requirements to exploit: A victim must run flatpak-builder on attacker-controlled manifest content that reaches a patch source with use-git-am: true. An earlier source in the same module must be able to create a Git repository in the shared extraction directory and place an executable hook under .git/hooks. Exposure is reduced when builds are confined to disposable or strongly isolated workers. Component affected: flatpak-builder-1.4.4-1.el10: source extraction in src/builder-source-patch.c (patch() / buildersourcepatchextract()), together with ordered source extraction in src/builder-module.c (buildermoduleextractsources()) Version affected: flatpak-builder-1.4.4-1.el10 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Private maintainer notification. CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - 7.8 (HIGH) AV:L - Exploitation requires a local build of attacker-supplied manifest content. AC:L - Once use-git-am: true is used, the exploit only needs predictable source ordering and an executable hook in .git/hooks. PR:N - The attacker does not need prior access to the build host; supplying the malicious manifest and sources is sufficient. UI:R - A victim must start the build of the malicious manifest. S:U - The resulting commands run in the same security scope as the flatpak-builder process, as the build user. C:H - Executed commands can read data available to the build user. I:H - Executed commands can modify build outputs and other files available to the build user. A:H - Executed commands can disrupt the build environment or delete accessible data. Impact: Important. Successful exploitation can execute arbitrary commands in the host build context of the user running flatpak-builder, directly affecting confidentiality, integrity, and availability of that user's resources. This is not Critical because exploitation is local, requires user interaction, and depends on the use-git-am path. Embargo: yes Reason: The issue provides a clear, reproducible route to host-side command execution during source extraction. Although exploitation requires a user to build attacker-supplied content, private coordination gives maintainers time to ship a fix before detailed reproduction guidance becomes public. Acknowledgement: Aisle Research Vulnerability Details: When use-git-am is enabled, the patch extraction helper builds a git am command and executes it through flatpakspawnv() in the extraction directory without disabling Git hooks: c static gboolean patch (GFile dir, gboolean usegit, gboolean usegitam, const char patchpath, char extraoptions, GError error, ...) { gboolean res; GPtrArray args; const gchar arg; valist ap; int i; vastart(ap, error); args = gptrarraynew (); if (usegit) { gptrarrayadd (args, "git"); gptrarrayadd (args, "apply"); gptrarrayadd (args, "-v"); } else if (usegitam) { gptrarrayadd (args, "git"); gptrarrayadd (args, "am"); gptrarrayadd (args, "--keep-cr"); } else { gptrarrayadd (args, "patch"); } ... res = flatpakspawnv (dir, NULL, 0, error, (const char ) args->pdata, NULL); Sources for a module are then extracted sequentially into the same destination directory: c for (l = self->sources; l != NULL; l = l->next) { BuilderSource source = l->data; if (!buildersourceisenabled (source, context)) continue; if (!buildersourceextract (source, dest, self->buildoptions, context, error)) { gprefixerror (error, "module %s: ", self->name); return FALSE; } } This combination allows an attacker-controlled earlier source to prepare .git/hooks/post-applypatch in the shared extraction tree, and a later patch source with use-git-am: true can then cause that hook to run in the host build environment. The impact established by the available evidence is command execution as the build user, not demonstrated privilege escalation beyond that context. The behavior is consistent with CWE-94. Steps to reproduce: 1. Prepare a local source tree such as poc-src/ containing any normal file and an executable .git/hooks/post-applypatch that performs a visible action, for example writing HOOKRAN to /tmp/flatpak-builder-hook-ran. 2. Prepare a valid mbox patch that can be applied by git am. 3. Use a manifest whose sources are ordered so that an earlier source creates a Git repository in the extraction directory, for example an archive source with git-init: true, followed by a dir source pointing to poc-src, followed by a patch source with use-git-am: true. 4. Run flatpak-builder <build-dir> <manifest.json>. 5. Observe that /tmp/flatpak-builder-hook-ran is created in the host/build environment after the patch step runs. Mitigation: Until a fixed package is available, avoid use-git-am: true when processing untrusted manifests or source material. If untrusted manifests must be built, run them only inside disposable VMs or equivalently strong isolation so that any unintended hook execution is contained to the worker. Proposed Fix: Disable Git hook discovery for internal git invocations used during patch extraction by setting core.hooksPath=/dev/null. diff diff --git a/src/builder-source-patch.c b/src/builder-source-patch.c index 0000000..0000000 100644 — a/src/builder-source-patch.c +++ b/src/builder-source-patch.c @@ -249,12 +249,16 @@ patch (GFile dir, args = gptrarraynew (); if (usegit) { gptrarrayadd (args, "git"); + gptrarrayadd (args, "-c"); + gptrarrayadd (args, "core.hooksPath=/dev/null"); gptrarrayadd (args, "apply"); gptrarrayadd (args, "-v"); } else if (usegitam) { gptrarrayadd (args, "git"); + gptrarrayadd (args, "-c"); + gptrarrayadd (args, "core.hooksPath=/dev/null"); gptrarrayadd (args, "am"); gptrarrayadd (args, "--keep-cr"); + gptrarrayadd (args, "--keep-cr"); } else { gptrarrayadd (args, "patch"); }

------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat