An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages.
xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
Impact: A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated.
Fixed in 0.1.9 by commits: e5702fca4dba9600721921fbca2dbc39dc5ca400 "proxy: Don't assume that only returns and errors have a reply-serial" fc027f759316fb2a6c45648200b6f100202eb84e "proxy: Make it clearer which direction messages are going in" e4465a0dfe96da3b39929a30a1ac3a22b16223e3 "proxy: Only allow replies to go to the correct destination"
Reported by @refi64.
Reference: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages.
xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
Impact: A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated.
Fixed in 0.1.9 by commits: e5702fca4dba9600721921fbca2dbc39dc5ca400 "proxy: Don't assume that only returns and errors have a reply-serial" fc027f759316fb2a6c45648200b6f100202eb84e "proxy: Make it clearer which direction messages are going in" e4465a0dfe96da3b39929a30a1ac3a22b16223e3 "proxy: Only allow replies to go to the correct destination"
Reported by @refi64.
Reference: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
xdg-dbus-proxy 0.1.9 fixes a security vulnerability, CVE-2026-94422: <https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq> <https://github.com/flatpak/xdg-dbus-proxy/releases/tag/0.1.9>
All versions older than 0.1.9 are vulnerable. An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages.
xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
Impact ======
A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox.
If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated.
Patches =======
Fixed in 0.1.9 by commits:
e5702fc "proxy: Don't assume that only returns and errors have a reply-serial" fc027f7 "proxy: Make it clearer which direction messages are going in" e4465a0 "proxy: Only allow replies to go to the correct destination"
Test coverage is provided by commits
4427d5d "tests: Add basic test coverage for reply handling" e7f2f89 "tests: Assert that "replies" of inappropriate types aren't accepted" 78045ce "tests: Assert that forged replies cannot be sent to wrong destination"
Workarounds ===========
Avoid running untrusted Flatpak apps.
Avoid running untrusted apps via other frameworks that use xdg-dbus-proxy.
Credits =======
Reported by @refi64. -- Simon McVittie, Collabora Ltd. / Debian
On Tue, 11 Aug 2026 at 17:52:36 +0100, Simon McVittie wrote: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c CVE-2026-93676 has been assigned.
smcv
A flaw was found in xdg-dbus-proxy. The filtering logic applied to D-Bus broadcast messages does not correctly enforce the configured path, interface, and member restrictions. As a result, a malicious or compromised Flatpak application can intercept broadcast signals on the D-Bus session bus and the AT-SPI bus that should have been filtered out, potentially exposing information from other applications on the bus to an unauthorized sandboxed application.
Upstream advisory: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c Affected versions: 0.1.6, 0.1.7 Fixed version: 0.1.8 Upstream CVSS: 3.2 (Low)
https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677
Last updated 27 May 2026