{"id":"CVE-2021-21261","aliases":["ALPINE-CVE-2021-21261","DEBIAN-CVE-2021-21261","DSA-4830-1","EUVD-2021-8642","GHSA-4ppf-fxf6-vxg2","MGASA-2021-0143","OESA-2021-1043","RHSA-2021:0304","RHSA-2021:0306","RHSA-2021:0307","RHSA-2021:0411","SUSE-SU-2021:1094-1","SUSE-SU-2022:2990-1","SUSE-SU-2022:3284-1","UBUNTU-CVE-2021-21261","USN-4721-1","openSUSE-SU-2021:0520-1","openSUSE-SU-2024:10762-1"],"status":"published","title":"Flatpak sandbox escape via spawn portal","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00595,"percentile":0.48936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2021-01-14T00:00:00Z","modified":"2026-11-03T06:32:47Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flatpak","fixed_in":["1.10.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flatpak","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"flatpak","fixed_in":["1.2.5-0+deb10u2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"flatpak","fixed_in":["1.0.3-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"flatpak","fixed_in":["1.0.3-3.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debugsource","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-selinux","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.6.2-5.el8_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak","fixed_in":["0:1.0.9-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.0.9-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-debugsource","fixed_in":["0:1.0.9-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-libs","fixed_in":["0:1.0.9-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.0.9-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-debugsource","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-libs","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-selinux","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-session-helper","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.6.2-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-debuginfo","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-libs","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-builder","fixed_in":["0:1.0.0-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-devel","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-builder","fixed_in":["0:1.0.0-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-debuginfo","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-devel","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-libs","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-debuginfo","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-libs","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-builder","fixed_in":["0:1.0.0-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-devel","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-debuginfo","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-libs","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-builder","fixed_in":["0:1.0.0-10.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-devel","fixed_in":["0:1.0.9-10.el7_9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libostree","fixed_in":["2020.8-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"flatpak","fixed_in":["1.10.2-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libostree","fixed_in":["2020.8-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"xdg-desktop-portal","fixed_in":["1.8.0-5.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"xdg-desktop-portal-gtk","fixed_in":["1.8.0-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flatpak","fixed_in":["1.0.9-0ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"flatpak","fixed_in":["1.6.5-0ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"flatpak","fixed_in":["1.10.2-lp152.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libostree","fixed_in":["2020.8-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"xdg-desktop-portal","fixed_in":["1.8.0-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"xdg-desktop-portal-gtk","fixed_in":["1.8.0-lp152.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.4"},{"fixed":"1.10.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-0+deb10u2"}]}],"versions":["1.2.4-1","1.2.5-0+deb10u1","1.2.5-0+deb10u1~bpo9+1"]},{"source":"osv","ecosystem":"Mageia:7","package":"libglib-testing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"appstream-glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.15-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"malcontent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"gnome-software","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.2-2.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-5.el8_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-10.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-10.el7_9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-5.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"xdg-desktop-portal-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.5.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150100.4.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-0ubuntu0.2"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.2"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-0ubuntu0.2"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.2"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-lp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xdg-desktop-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xdg-desktop-portal-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-1.2"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"flatpak","product":"flatpak"}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-4ppf-fxf6-vxg2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/flatpak/flatpak/releases/tag/1.8.5","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4830","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/flatpak/flatpak/commit/6d1773d2a54dde9b099043f07a2094a4f1c2f486","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/flatpak/flatpak/commit/6e5ae7a109cdfa9735ea7ccbd8cb79f9e8d3ae8b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/flatpak/flatpak/commit/aeb6a7ab0abaac4a8f4ad98b3df476d9de6b8bd4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/flatpak/flatpak/commit/cc1401043c075268ecc652eac557ef8076b5eaba","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202101-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-21261","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21261","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0143.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27126","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25978","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28575","tags":["report"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/issues/4146","tags":["report"]},{"url":"https://github.com/flatpak/flatpak/releases","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2K2Q5P4IIUN2SFJKQKB4UJQ37CE2E55K/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21261","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0304","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917430","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0304.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21261","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0306","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0306.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0307","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0307.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0411","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0411.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211094-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133120","tags":["report"]},{"url":"https://bugzilla.suse.com/1133124","tags":["report"]},{"url":"https://bugzilla.suse.com/1175899","tags":["report"]},{"url":"https://bugzilla.suse.com/1180996","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21261","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1155688","tags":["report"]},{"url":"https://bugzilla.suse.com/1183459","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21381","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223284-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191507","tags":["report"]},{"url":"https://bugzilla.suse.com/1194610","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43860","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-21261","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4721-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4JRX7C3J3TJQXJODJCARSGDYY4AM57Q7/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5736","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-21261","title":"Flatpak sandbox escape via spawn portal","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T19:40:21Z","modified":"2024-08-03T18:09:14.989Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-8642","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T19:40:21Z","modified":"2024-08-03T18:09:14Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T03:25:06.913643Z"}],"nvd":[{"id":"CVE-2021-21261","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T20:15:12.36Z","modified":"2026-06-17T03:35:08.87Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"ALPINE-CVE-2021-21261","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T20:15:12.36Z","modified":"2026-11-03T06:32:47.041636779Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-21261","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T20:15:12.36Z","modified":"2026-10-20T14:15:20.971945227Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21261","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T20:15:12.36Z","modified":"2026-10-23T18:03:11.660341646Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"OESA-2021-1043","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\r\n\r\nFlatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.9.4. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.9.4.(CVE-2021-21261)","status":"published","published":"2021-03-05T11:04:16Z","modified":"2026-08-18T01:15:12.996668143Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:0304","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2024-09-16T05:21:41Z","modified":"2025-11-22T12:16:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0306","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2024-09-16T05:21:48Z","modified":"2025-11-22T12:16:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0307","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2024-09-16T05:21:54Z","modified":"2025-11-22T12:16:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0411","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2024-09-16T05:22:01Z","modified":"2026-06-26T12:22:27.792638917Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2021-21261","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.","status":"published","published":"2021-01-14T20:15:00Z","modified":"2026-04-22T12:46:17.856506Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DSA-4830-1","title":"flatpak - security update","status":"published","published":"2021-01-14T00:00:00Z","modified":"2026-03-09T02:09:05.568448Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0143","title":"Updated flatpak packages fix security vulnerabilities","description":"Sandbox escape where a malicious application can execute code outside the\nsandbox by controlling the environment of the \"flatpak run\" command when\nspawning a sub-sandbox (CVE-2021-21261).\n\nA potential attack where a flatpak application could use custom formatted\n.desktop files to gain access to files on the host system (CVE-2021-21381).\n\nThe update also removes the unnecessary flatpak-tests subpackage.\n","status":"published","published":"2021-03-18T09:56:09Z","modified":"2026-04-16T04:40:53.588066515Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0520-1","title":"Security update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk","description":"This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues:\n\nlibostree:\n\nUpdate to version 2020.8\n\n- Enable LTO. (bsc#1133120)\n\n- This update contains scalability improvements and bugfixes.\n- Caching-related HTTP headers are now supported on summaries and signatures, so that they do not have to be \n  re-downloaded if not changed in the meanwhile.\n- Summaries and delta have been reworked to allow more fine-grained fetching.\n- Fixes several bugs related to atomic variables, HTTP timeouts, and 32-bit architectures.\n- Static deltas can now be signed to more easily support offline verification.\n- There's now support for multiple initramfs images; Is it possible to have a 'main' initramfs image and a \n  secondary one which represents local configuration.\n- The documentation is now moved to https://ostreedev.github.io/ostree/\n- Fix for an assertion failure when upgrading from systems before ostree supported devicetree.\n- ostree no longer hardlinks zero sized files to avoid hitting filesystem maximum link counts.\n- ostree now supports `/` and `/boot` being on the same filesystem.\n- Improvements to the GObject Introspection metadata, some (cosmetic) static analyzer fixes, a fix for \n  the immutable bit on s390x, dropping a deprecated bit in the systemd unit file.\n- Fix a regression 2020.4 where the 'readonly sysroot' changes incorrectly left the sysroot read-only \n  on systems that started out with a read-only `/` (most of them, e.g. Fedora Silverblue/IoT at least).\n- The default dracut config now enables reproducibility.\n- There is a new ostree admin unlock `--transient`. This should to be a foundation for further support \n  for 'live' updates.\n- New `ed25519` signing support, powered by `libsodium`.\n- stree commit gained a new `--base` argument, which significantly simplifies constructing 'derived' \n  commits, particularly for systems using SELinux.\n- Handling of the read-only sysroot was reimplemented to run in the initramfs and be more reliable. \n  Enabling the `readonly=true` flag in the repo config is recommended.\n- Several fixes in locking for the temporary 'staging' directories OSTree creates, particularly on NFS.\n- A new `timestamp-check-from-rev` option was added for pulls, which makes downgrade protection more \n  reliable and will be used by Fedora CoreOS.\n- Several fixes and enhancements made for 'collection' pulls including a new `--mirror` option.\n- The ostree commit command learned a new `--mode-ro-executables` which enforces `W^R` semantics \n  on all executables.\n- Added a new  commit metadata key `OSTREE_COMMIT_META_KEY_ARCHITECTURE` to help standardize \n  the architecture of the OSTree commit. This could be used on the client side for example to \n  sanity-check that the commit matches the architecture of the machine before deploying.\n- Stop invalid usage of `%_libexecdir`:\n  + Use `%{_prefix}/lib` where appropriate.\n  + Use `_systemdgeneratordir` for the systemd-generators.\n  + Define `_dracutmodulesdir` based on `dracut.pc`. Add BuildRequires(dracut) for this to work.\n\nxdg-desktop-portal:\n\nUpdate to version 1.8.0:\n\n- Ensure systemd rpm macros are called at install/uninstall times for systemd user services.\n- Add BuildRequires on systemd-rpm-macros.\n- openuri:\n  - Allow skipping the chooser for more URL tyles\n  - Robustness fixes\n- filechooser: \n  - Return the current filter\n  - Add a 'directory' option\n  - Document the 'writable' option\n- camera:\n  - Make the client node visible\n  - Don't leak pipewire proxy\n- Fix file descriptor leaks\n- Testsuite improvements\n- Updated translations.\n- document:\n  - Reduce the use of open fds\n  - Add more tests and fix issues they found\n  - Expose directories with their proper name\n  - Support exporting directories\n  - New fuse implementation\n- background: Avoid a segfault\n- screencast: Require pipewire 0.3\n- Better support for snap and toolbox\n- Require `/usr/bin/fusermount`: `xdg-document-portal` calls out to the binary. (bsc#1175899)\n  Without it, files or dirs can be selected, but whatever is done with or in them, will not have any effect\n- Fixes for `%_libexecdir` changing to `/usr/libexec`\n\nxdg-desktop-portal-gtk:\n\nUpdate to version 1.8.0:\n\n- filechooser: \n  - Return the current filter\n    - Handle the 'directory' option to select directories\n    - Only show preview when we have an image\n- screenshot: Fix cancellation\n- appchooser: Avoid a crash\n- wallpaper:\n  - Properly preview placement settings\n  - Drop the lockscreen option\n- printing: Improve the notification\n- Updated translations.\n- settings: Fall back to gsettings for enable-animations\n- screencast: Support Mutter version to 3 (New pipewire api ver 3).\n\nflatpak:\n\n-  Update to version 1.10.2 (jsc#SLE-17238, ECO-3148)\n\n-  This is a security update which fixes a potential attack where a flatpak application could use custom formated \n   `.desktop` file to gain access to files on the host system.\n- Fix memory leaks\n- Documentation and translations updates\n- Spawn portal better handles non-utf8 filenames\n- Fix flatpak build on systems with setuid bwrap \n- Fix crash on updating apps with no deploy data\n- Remove deprecated texinfo packaging macros.\n- Support for the new repo format which should make updates faster and download less data.\n- The systemd generator snippets now call flatpak `--print-updated-env` in place of a bunch of shell for better\n  login performance.\n- The `.profile` snippets now disable GVfs when calling flatpak to avoid spawning a gvfs daemon when logging in via ssh.\n- Flatpak now finds the pulseaudio sockets better in uncommon configurations.\n- Sandboxes with network access it now also has access to the `systemd-resolved` socket to do dns lookups.\n- Flatpak supports unsetting environment variables in the sandbox using `--unset-env`, \n  and `--env=FOO=` now sets FOO to the empty string instead of unsetting it.\n- The spawn portal now has an option to share the pid namespace with the sub-sandbox.\n- This security update fixes a sandbox escape where a malicious application can execute code outside the sandbox by \n  controlling the environment of the 'flatpak run' command when spawning a sub-sandbox (bsc#1180996, CVE-2021-21261)\n- Fix support for ppc64.\n- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage, allow to remove python3 dependency on main package.\n- Enable LTO as gobject-introspection works fine with LTO. (bsc#1133124)\n- Fixed progress reporting for OCI and extra-data.\n- The in-memory summary cache is more efficient.\n- Fixed authentication getting stuck in a loop in some cases.\n- Fixed authentication error reporting.\n- Extract OCI info for runtimes as well as apps. \n- Fixed crash if anonymous authentication fails and `-y` is specified.\n- flatpak info now only looks at the specified installation if one is specified.\n- Better error reporting for server HTTP errors during download. \n- Uninstall now removes applications before the runtime it depends on.\n- Avoid updating metadata from the remote when uninstalling.\n- FlatpakTransaction now verifies all passed in refs to avoid.\n- Added validation of collection id settings for remotes.\n- Fix seccomp filters on s390.\n- Robustness fixes to the spawn portal.\n- Fix support for masking update in the system installation.\n- Better support for distros with uncommon models of merged `/usr`.\n- Cache responses from localed/AccountService.\n- Fix hangs in cases where `xdg-dbus-proxy` fails to start.\n- Fix double-free in cups socket detection.\n- OCI authenticator now doesn't ask for auth in case of http errors.\n- Fix invalid usage of `%{_libexecdir}` to reference systemd directories.\n- Fixes for `%_libexecdir` changing to `/usr/libexec`\n- Avoid calling authenticator in update if ref didn't change\n- Don't fail transaction if ref is already installed (after transaction start)\n- Fix flatpak run handling of userns in the `--device=all` case\n- Fix handling of extensions from different remotes\n- Fix flatpak run `--no-session-bus`\n- `FlatpakTransaction` has a new signal `install-authenticator` which clients can handle to install authenticators \n   needed for the transaction. This is done in the CLI commands.\n- Now the host timezone data is always exposed, fixing several apps that had timezone issues.\n- There's a new  systemd unit (not installed by default) to automatically detect plugged in usb sticks with \n  sideload repos.\n- By default the `gdm env.d` file is no longer installed because the  systemd generators work better.\n- `create-usb` now exports partial commits by default \n- Fix handling of docker media types in oci remotes\n- Fix subjects in `remote-info --log` output\n- This release is also able to host flatpak images on e.g. docker hub.\n \nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-08T22:41:52Z","modified":"2026-02-04T04:10:39.938614Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10762-1","title":"flatpak-1.11.3-1.2 on GA media","description":"These are all security issues fixed in the flatpak-1.11.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:12.056832Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:1094-1","title":"Security update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk","description":"This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues:\n\nlibostree:\n\nUpdate to version 2020.8\n\n- Enable LTO. (bsc#1133120)\n\n- This update contains scalability improvements and bugfixes.\n- Caching-related HTTP headers are now supported on summaries and signatures, so that they do not have to be \n  re-downloaded if not changed in the meanwhile.\n- Summaries and delta have been reworked to allow more fine-grained fetching.\n- Fixes several bugs related to atomic variables, HTTP timeouts, and 32-bit architectures.\n- Static deltas can now be signed to more easily support offline verification.\n- There's now support for multiple initramfs images; Is it possible to have a 'main' initramfs image and a \n  secondary one which represents local configuration.\n- The documentation is now moved to https://ostreedev.github.io/ostree/\n- Fix for an assertion failure when upgrading from systems before ostree supported devicetree.\n- ostree no longer hardlinks zero sized files to avoid hitting filesystem maximum link counts.\n- ostree now supports `/` and `/boot` being on the same filesystem.\n- Improvements to the GObject Introspection metadata, some (cosmetic) static analyzer fixes, a fix for \n  the immutable bit on s390x, dropping a deprecated bit in the systemd unit file.\n- Fix a regression 2020.4 where the 'readonly sysroot' changes incorrectly left the sysroot read-only \n  on systems that started out with a read-only `/` (most of them, e.g. Fedora Silverblue/IoT at least).\n- The default dracut config now enables reproducibility.\n- There is a new ostree admin unlock `--transient`. This should to be a foundation for further support \n  for 'live' updates.\n- New `ed25519` signing support, powered by `libsodium`.\n- stree commit gained a new `--base` argument, which significantly simplifies constructing 'derived' \n  commits, particularly for systems using SELinux.\n- Handling of the read-only sysroot was reimplemented to run in the initramfs and be more reliable. \n  Enabling the `readonly=true` flag in the repo config is recommended.\n- Several fixes in locking for the temporary 'staging' directories OSTree creates, particularly on NFS.\n- A new `timestamp-check-from-rev` option was added for pulls, which makes downgrade protection more \n  reliable and will be used by Fedora CoreOS.\n- Several fixes and enhancements made for 'collection' pulls including a new `--mirror` option.\n- The ostree commit command learned a new `--mode-ro-executables` which enforces `W^R` semantics \n  on all executables.\n- Added a new  commit metadata key `OSTREE_COMMIT_META_KEY_ARCHITECTURE` to help standardize \n  the architecture of the OSTree commit. This could be used on the client side for example to \n  sanity-check that the commit matches the architecture of the machine before deploying.\n- Stop invalid usage of `%_libexecdir`:\n  + Use `%{_prefix}/lib` where appropriate.\n  + Use `_systemdgeneratordir` for the systemd-generators.\n  + Define `_dracutmodulesdir` based on `dracut.pc`. Add BuildRequires(dracut) for this to work.\n\nxdg-desktop-portal:\n\nUpdate to version 1.8.0:\n\n- Ensure systemd rpm macros are called at install/uninstall times for systemd user services.\n- Add BuildRequires on systemd-rpm-macros.\n- openuri:\n  - Allow skipping the chooser for more URL tyles\n  - Robustness fixes\n- filechooser: \n  - Return the current filter\n  - Add a 'directory' option\n  - Document the 'writable' option\n- camera:\n  - Make the client node visible\n  - Don't leak pipewire proxy\n- Fix file descriptor leaks\n- Testsuite improvements\n- Updated translations.\n- document:\n  - Reduce the use of open fds\n  - Add more tests and fix issues they found\n  - Expose directories with their proper name\n  - Support exporting directories\n  - New fuse implementation\n- background: Avoid a segfault\n- screencast: Require pipewire 0.3\n- Better support for snap and toolbox\n- Require `/usr/bin/fusermount`: `xdg-document-portal` calls out to the binary. (bsc#1175899)\n  Without it, files or dirs can be selected, but whatever is done with or in them, will not have any effect\n- Fixes for `%_libexecdir` changing to `/usr/libexec`\n\nxdg-desktop-portal-gtk:\n\nUpdate to version 1.8.0:\n\n- filechooser: \n  - Return the current filter\n    - Handle the 'directory' option to select directories\n    - Only show preview when we have an image\n- screenshot: Fix cancellation\n- appchooser: Avoid a crash\n- wallpaper:\n  - Properly preview placement settings\n  - Drop the lockscreen option\n- printing: Improve the notification\n- Updated translations.\n- settings: Fall back to gsettings for enable-animations\n- screencast: Support Mutter version to 3 (New pipewire api ver 3).\n\nflatpak:\n\n-  Update to version 1.10.2 (jsc#SLE-17238, ECO-3148)\n\n-  This is a security update which fixes a potential attack where a flatpak application could use custom formated \n   `.desktop` file to gain access to files on the host system.\n- Fix memory leaks\n- Documentation and translations updates\n- Spawn portal better handles non-utf8 filenames\n- Fix flatpak build on systems with setuid bwrap \n- Fix crash on updating apps with no deploy data\n- Remove deprecated texinfo packaging macros.\n- Support for the new repo format which should make updates faster and download less data.\n- The systemd generator snippets now call flatpak `--print-updated-env` in place of a bunch of shell for better\n  login performance.\n- The `.profile` snippets now disable GVfs when calling flatpak to avoid spawning a gvfs daemon when logging in via ssh.\n- Flatpak now finds the pulseaudio sockets better in uncommon configurations.\n- Sandboxes with network access it now also has access to the `systemd-resolved` socket to do dns lookups.\n- Flatpak supports unsetting environment variables in the sandbox using `--unset-env`, \n  and `--env=FOO=` now sets FOO to the empty string instead of unsetting it.\n- The spawn portal now has an option to share the pid namespace with the sub-sandbox.\n- This security update fixes a sandbox escape where a malicious application can execute code outside the sandbox by \n  controlling the environment of the 'flatpak run' command when spawning a sub-sandbox (bsc#1180996, CVE-2021-21261)\n- Fix support for ppc64.\n- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage, allow to remove python3 dependency on main package.\n- Enable LTO as gobject-introspection works fine with LTO. (bsc#1133124)\n- Fixed progress reporting for OCI and extra-data.\n- The in-memory summary cache is more efficient.\n- Fixed authentication getting stuck in a loop in some cases.\n- Fixed authentication error reporting.\n- Extract OCI info for runtimes as well as apps. \n- Fixed crash if anonymous authentication fails and `-y` is specified.\n- flatpak info now only looks at the specified installation if one is specified.\n- Better error reporting for server HTTP errors during download. \n- Uninstall now removes applications before the runtime it depends on.\n- Avoid updating metadata from the remote when uninstalling.\n- FlatpakTransaction now verifies all passed in refs to avoid.\n- Added validation of collection id settings for remotes.\n- Fix seccomp filters on s390.\n- Robustness fixes to the spawn portal.\n- Fix support for masking update in the system installation.\n- Better support for distros with uncommon models of merged `/usr`.\n- Cache responses from localed/AccountService.\n- Fix hangs in cases where `xdg-dbus-proxy` fails to start.\n- Fix double-free in cups socket detection.\n- OCI authenticator now doesn't ask for auth in case of http errors.\n- Fix invalid usage of `%{_libexecdir}` to reference systemd directories.\n- Fixes for `%_libexecdir` changing to `/usr/libexec`\n- Avoid calling authenticator in update if ref didn't change\n- Don't fail transaction if ref is already installed (after transaction start)\n- Fix flatpak run handling of userns in the `--device=all` case\n- Fix handling of extensions from different remotes\n- Fix flatpak run `--no-session-bus`\n- `FlatpakTransaction` has a new signal `install-authenticator` which clients can handle to install authenticators \n   needed for the transaction. This is done in the CLI commands.\n- Now the host timezone data is always exposed, fixing several apps that had timezone issues.\n- There's a new  systemd unit (not installed by default) to automatically detect plugged in usb sticks with \n  sideload repos.\n- By default the `gdm env.d` file is no longer installed because the  systemd generators work better.\n- `create-usb` now exports partial commits by default \n- Fix handling of docker media types in oci remotes\n- Fix subjects in `remote-info --log` output\n- This release is also able to host flatpak images on e.g. docker hub.\n ","status":"published","published":"2021-04-07T12:11:43Z","modified":"2026-02-04T04:37:57.829588Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2022:2990-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2021-21381: Fixed an issue where a sandboxed application could\n  read and write arbitrary host files via special tokens in the\n  .desktop file (bsc#1183459).\n- CVE-2021-21261: Fixed a sandbox escape issue via the flatpak-portal\n  service (bsc#1180996).\n\nNon-security fixes:\n\n- openh264 extension needs to use 'extra_data'. (bsc#1155688)\n  The update will provide the support for extra_data' in extensions\n  and will provide a list of versions that are supported. This will\n  be useful for the extra_data for extensions because that will require\n  it to say that it is supported for version \u003e 1.2.5 in the 1.2 series \n  and \u003e 1.4.2 otherwise.\n  The update  will includes fixes for a segfault in the function that \n  lists the installed references (flatpak_installation_list_installed_refs).\n  When an appstream update is cancelled while downloading icons, the update\n  will show a proper fail. Before this fix the next update attempt will see\n  an up-to-date timestamp, think everyhing is ok and not download the missing icons.\n  The update will introduce checks in the OCI (Open Container Initiative format)\n  updates for validating if it is gpg verified.\n  The update will install the required runtime for the installed extension.\n  The update will prevent a crash if the 'FlatpakDir' can't ensure it has a repo configured.\n  The update will prevent the removal of local extensions considered remote and not locally related.\n","status":"published","published":"2022-09-01T13:47:39Z","modified":"2026-02-04T02:34:01.833252Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3284-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2021-41133: Fixed sandbox bypass via recent syscalls (bsc#1191507).\n- CVE-2021-43860: Fixed metadata validation (bsc#1194610).\n","status":"published","published":"2022-09-15T14:23:18Z","modified":"2026-02-04T02:45:22.977547Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-4721-1","title":"flatpak vulnerability","description":"Simon McVittie discovered that flatpak-portal service allowed sandboxed\napplications to execute arbitrary code on the host system (a sandbox\nescape). A malicious user could create a Flatpak application that set\nenvironment variables, trusted by the Flatpak \"run\" command, and use it\nto execute arbitrary code outside the sandbox.\n","status":"published","published":"2021-02-04T19:45:36Z","modified":"2026-04-22T10:11:23.020329Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}