CVE-2026-86320
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process.
Risk Assessment
This results in arbitrary code execution with the privileges of the user running flatpak-builder, potentially compromising the build system.
Recommendation
Update flatpak-builder to a version containing the fix and avoid applying untrusted patch sources with use-git-am: true.
Other vulnerabilities in flatpak-builder
See all- CVE-2026-107466Medium
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
- CVE-2026-39977Medium
flatpak-builder from 1.4.5 to before 1.4.8 allows reading arbitrary host files via the license-files manifest key because path validation does not resolve symlinks in intermediate components. Copied files end up in the build output; the issue is fixed in 1.4.8.
Original NVD description (English source)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS