CVE-2026-55889
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileTransfer.RetrieveFiles to redirect drag-and-drop and copy-paste data intended for other applications to themselves. Access tokens were generated with g_random_int or g_uuid_string_random based on Mersenne Twister, allowing recovery of PRNG state and prediction of subsequent tokens.
Risk Assessment
Potential interception of user data intended for other applications and unauthorized access to resources.
Recommendation
Update XDG Desktop Portal to version 1.22.1 or later, which contains the fix for this issue.
Other vulnerabilities in XDG Desktop Portal
See all- CVE-2026-55888High
In XDG Desktop Portal before version 1.22.1, malicious sandboxed applications can use FileChooser.SaveFiles to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). Filenames are not validated by the frontend or common backends, which are supposed to check that the file does not already exist.
- CVE-2026-40354Low
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. The vulnerability is fixed in 1.20.4 and 1.21.1.
Original NVD description (English source)
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS