RLSA-2026:98642: Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources.
Security Fix(es):
flatpak-builder: Host code execution via git am hook execution in patch source extraction (use-git-am) (CVE-2026-86320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/flatpak-builderto a version that resolves this vulnerability.Fixed in 0:1.4.7-1.el10_3.1 - Upgrade
Upgrade
rocky-linux/flatpak-builder-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.4.7-1.el10_3.1 - Upgrade
Upgrade
rocky-linux/flatpak-builder-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.4.7-1.el10_3.1
Event History
Frequently Asked Questions
What conditions are indicated for exploitation?
The CVSS vector indicates local access is required, no privileges are required, and user interaction is required. The issue is associated with hook execution during patch source extraction using use-git-am.
Which Rocky Linux packages are covered by this update?
The advisory lists rocky-linux/flatpak-builder, rocky-linux/flatpak-builder-debugsource, and rocky-linux/flatpak-builder-debuginfo.