https://seclists.org/oss-sec/2026/q3/603: bubblewrap 0.12.0 fixes writes outside sandbox
Published Aug 27, 2026
·Updated
Affected Software
1 affected component
bubblewrap<0.12.0
Deployments that use bubblewrap to create files within attacker-controlled filesystem content, such as a malicious app image, are exposed. Flatpak is affected when a malicious or compromised app is used, and similar application frameworks may also be affected depending on how they invoke bubblewrap.
The attacker needs attacker-controlled filesystem content that bubblewrap uses while creating files during sandbox setup. Bubblewrap arguments are not typically attacker-controlled, so exploitability depends on the specific integration and invocation.
No runtime escape is involved: the redirected file creation occurs before the sandbox starts. Files are created with the UID and GID that launched bubblewrap, which is generally not root, so the resulting sandbox escape is not privileged.
All bubblewrap versions older than 0.12.0 are vulnerable. The issue is tracked as GHSA-pxhw-h44j-8pfx while a CVE ID is pending.