https://seclists.org/oss-sec/2026/q3/603: bubblewrap 0.12.0 fixes writes outside sandbox

Q: Which deployments are most exposed?

Deployments that use bubblewrap to create files within attacker-controlled filesystem content, such as a malicious app image, are exposed. Flatpak is affected when a malicious or compromised app is used, and similar application frameworks may also be affected depending on how they invoke bubblewrap.

Q: What must an attacker control to exploit this issue?

The attacker needs attacker-controlled filesystem content that bubblewrap uses while creating files during sandbox setup. Bubblewrap arguments are not typically attacker-controlled, so exploitability depends on the specific integration and invocation.

Q: Does successful exploitation provide a runtime sandbox escape or root-level access?

No runtime escape is involved: the redirected file creation occurs before the sandbox starts. Files are created with the UID and GID that launched bubblewrap, which is generally not root, so the resulting sandbox escape is not privileged.

Q: Which versions require remediation?

All bubblewrap versions older than 0.12.0 are vulnerable. The issue is tracked as GHSA-pxhw-h44j-8pfx while a CVE ID is pending.

Published Aug 27, 2026

Updated

Affected Software

1 affected component

bubblewrap<0.12.0

Frequently Asked Questions

Which deployments are most exposed?

Deployments that use bubblewrap to create files within attacker-controlled filesystem content, such as a malicious app image, are exposed. Flatpak is affected when a malicious or compromised app is used, and similar application frameworks may also be affected depending on how they invoke bubblewrap.

What must an attacker control to exploit this issue?

The attacker needs attacker-controlled filesystem content that bubblewrap uses while creating files during sandbox setup. Bubblewrap arguments are not typically attacker-controlled, so exploitability depends on the specific integration and invocation.

Does successful exploitation provide a runtime sandbox escape or root-level access?

No runtime escape is involved: the redirected file creation occurs before the sandbox starts. Files are created with the UID and GID that launched bubblewrap, which is generally not root, so the resulting sandbox escape is not privileged.

Which versions require remediation?

All bubblewrap versions older than 0.12.0 are vulnerable. The issue is tracked as GHSA-pxhw-h44j-8pfx while a CVE ID is pending.