RLSA-2026:98536: Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
flatpak-builder: Host code execution via git am hook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/flatpak-builderto a version that resolves this vulnerability.Fixed in 0:1.2.3-1.el9_8.1
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The vulnerability is triggered during patch source extraction when flatpak-builder uses the `use-git-am` option. Exploitation involves a Git patch that causes hook execution through `git am`.
What systems or workflows are most exposed?
Systems that use flatpak-builder to build Flatpaks from source and enable `use-git-am` during patch source extraction are exposed. The described impact is host code execution, so the build host is the relevant security boundary.
What can be done while the update cannot be applied?
Avoid using `use-git-am` for patch source extraction, particularly with patches from untrusted or insufficiently reviewed sources. Treat Git patches processed by affected build workflows as potentially capable of executing code on the host.