https://seclists.org/oss-sec/2026/q3/884: xdg-dbus-proxy 0.1.9 fixes sandbox escape CVE-2026-94422
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
All xdg-dbus-proxy versions older than 0.1.9 are vulnerable. This includes Flatpak deployments and any other application framework that relies on xdg-dbus-proxy as part of its sandbox boundary, such as Firejail.
What must an attacker be able to do to exploit it?
The attacker needs to control a malicious or compromised sandboxed application that can interact with the D-Bus session bus through xdg-dbus-proxy. It bypasses filtering by setting a reply serial number on a message that is not a reply.
What is the practical impact for Flatpak users?
A malicious or compromised Flatpak application could achieve arbitrary code execution outside of its sandbox. Frameworks using xdg-dbus-proxy in an equivalent way can have the same impact.
How can I remediate the vulnerability?
Update xdg-dbus-proxy to version 0.1.9 or later. The supplied information does not describe a workaround for installations that cannot yet update.