{"id":"CVE-2026-86320","aliases":["ALPINE-CVE-2026-86320","ALSA-2026:80495","ALSA-2026:80496","ALSA-2026:80973","CLSA-2026-1792771054","DEBIAN-CVE-2026-86320","EUVD-2026-81387","GHSA-rvpr-5p35-6vf8","MGASA-2026-0519","OESA-2026-4074","OESA-2026-4224","OESA-2026-4225","OESA-2026-4226","RHSA-2026:80495","RHSA-2026:80496","RHSA-2026:80973","RHSA-2026:84832","RHSA-2026:84833","RHSA-2026:84834","RHSA-2026:84842","RLSA-2026:80495","RLSA-2026:80496","RLSA-2026:80973","UBUNTU-CVE-2026-86320","openSUSE-SU-2026:11845-1"],"status":"published","title":"Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00299,"percentile":0.22763,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-09-17T07:27:33Z","modified":"2026-11-03T06:33:04Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"flatpak-builder","fixed_in":["1.4.11-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"flatpak-builder","fixed_in":["1.4.4-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flatpak-builder","fixed_in":["1.2.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"flatpak-builder","fixed_in":["1.2.3-2.el8_10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-builder","fixed_in":["1.2.3-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak-builder","fixed_in":["1.4.11-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"flatpak-builder","fixed_in":["1.4.12-1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"flatpak-builder","fixed_in":["1.0.14-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"flatpak-builder","fixed_in":["1.3.5-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"flatpak-builder","fixed_in":["1.3.5-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"flatpak-builder","fixed_in":["1.3.5-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-builder","fixed_in":["0:1.4.4-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-builder-debuginfo","fixed_in":["0:1.4.4-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-builder-debugsource","fixed_in":["0:1.4.4-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-builder","fixed_in":["0:1.2.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-builder-debuginfo","fixed_in":["0:1.2.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-builder-debugsource","fixed_in":["0:1.2.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-builder","fixed_in":["0:1.2.3-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-builder-debuginfo","fixed_in":["0:1.2.3-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-builder-debugsource","fixed_in":["0:1.2.3-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-builder","fixed_in":["0:1.2.3-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-builder-debuginfo","fixed_in":["0:1.2.3-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-builder-debugsource","fixed_in":["0:1.2.3-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-builder","fixed_in":["0:1.2.3-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-builder-debuginfo","fixed_in":["0:1.2.3-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-builder-debugsource","fixed_in":["0:1.2.3-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-builder","fixed_in":["0:1.4.4-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-builder-debuginfo","fixed_in":["0:1.4.4-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-builder-debugsource","fixed_in":["0:1.4.4-1.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-builder","fixed_in":["0:1.2.2-2.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-builder-debuginfo","fixed_in":["0:1.2.2-2.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-builder-debugsource","fixed_in":["0:1.2.2-2.el9_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"flatpak-builder","fixed_in":["0:1.4.4-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"flatpak-builder","fixed_in":["0:1.2.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"flatpak-builder","fixed_in":["0:1.2.3-2.el8_10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"flatpak-builder","fixed_in":["1.4.12-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-2.el8_10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1","1.3.1-1","1.3.3-1","1.3.4-1","1.3.5-1","1.4.0-1","1.4.1-1","1.4.10-1","1.4.11-1","1.4.12-1","1.4.12-2","1.4.2-1","1.4.4-1","1.4.4-1~bpo12+1","1.4.4-2","1.4.5-1","1.4.6-1","1.4.6-2","1.4.7-1","1.4.8-1","1.4.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.10-1","1.4.11-1","1.4.12-1","1.4.12-2","1.4.4-2","1.4.5-1","1.4.6-1","1.4.6-2","1.4.7-1","1.4.8-1","1.4.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1"}]}],"versions":["1.4.10-1","1.4.4-2","1.4.5-1","1.4.6-1","1.4.6-2","1.4.7-1","1.4.8-1","1.4.9-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.12-1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-builder-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-builder-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.4-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.3-2.el8_10"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1-1","0.10.4-1","0.10.5-1","0.10.6-1","0.10.6-2","0.10.7-1","0.10.8-1","0.10.9-1","0.10.9-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.8-2","1.0.9-1","1.0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.14-2","1.2.0-1","1.2.1-1","1.2.2-1","1.2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1","1.4.0-1","1.4.1-1","1.4.2-1build1","1.4.2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.8-1","1.4.9-1","1.4.10-1","1.4.11-1","1.4.12-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.6-2","1.4.7-1","1.4.8-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.12-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:80495","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80496","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80973","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84832","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84833","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84834","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84842","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86714","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90896","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92220","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86320","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2471023","tags":["issue-tracking","x_refsource_REDHAT","exploit","report"]},{"url":"https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv","tags":["exploit","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86320","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rvpr-5p35-6vf8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-86320","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2471023","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-80495.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80496.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-80973.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792771054.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-86320","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0519.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36407","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BJF2ORPRVKVTXPAFIDS6U5SNJHW6VTMX/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJHPETQUQKC4Z7Z3LWM37VPXNFDJHFGB/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4074","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4224","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4225","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4226","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80495.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86320","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80496.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80973.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84832.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84833.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84834.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84842.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80495","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80496","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80973","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-86320","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86320","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-86320","title":"Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T07:27:33.167Z","modified":"2026-11-03T04:15:37.263Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-03T06:40:44.279652Z"}],"euvd":[{"id":"EUVD-2026-81387","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T07:27:33Z","modified":"2026-11-03T04:15:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T06:45:42.824417Z"}],"ghsa":[{"id":"GHSA-rvpr-5p35-6vf8","title":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources...","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T09:33:01Z","modified":"2026-10-30T03:31:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:14:41.240878Z"}],"nvd":[{"id":"CVE-2026-86320","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T08:17:02.2Z","modified":"2026-10-30T01:16:47.843Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"ALPINE-CVE-2026-86320","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T08:17:02.2Z","modified":"2026-11-03T06:33:04.138256979Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"DEBIAN-CVE-2026-86320","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T08:17:02.2Z","modified":"2026-10-30T09:49:04.207410886Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"OESA-2026-4074","title":"flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)","status":"published","published":"2026-09-25T01:28:05Z","modified":"2026-09-25T01:45:11.30864078Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4224","title":"flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)","status":"published","published":"2026-09-30T13:47:45Z","modified":"2026-10-01T02:00:10.121720041Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4225","title":"flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)","status":"published","published":"2026-09-30T13:47:46Z","modified":"2026-10-01T02:00:09.692186328Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4226","title":"flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.(CVE-2026-86320)","status":"published","published":"2026-09-30T13:47:47Z","modified":"2026-10-01T02:00:08.920045464Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:80495","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-14T10:31:41Z","modified":"2026-10-20T10:16:25Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80496","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-14T10:31:41Z","modified":"2026-10-20T10:16:25Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80973","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-14T10:32:21Z","modified":"2026-10-20T10:16:52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84832","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-20T10:17:51Z","modified":"2026-10-20T10:31:37.354899593Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84833","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-20T10:17:52Z","modified":"2026-10-20T10:31:26.046033056Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84834","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-20T10:17:52Z","modified":"2026-10-20T10:32:23.674881024Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84842","title":"Red Hat Security Advisory: flatpak-builder security update","status":"published","published":"2026-10-20T10:17:53Z","modified":"2026-10-20T10:32:23.672923313Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:80495","title":"Important: flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\n\nSecurity Fix(es):\n\n* flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:08:58.021554Z","modified":"2026-10-13T12:30:02.888163416Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80496","title":"Important: flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\n\nSecurity Fix(es):\n\n* flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:04:29.039883Z","modified":"2026-10-13T12:30:02.888365292Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80973","title":"Important: flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.\n\nSecurity Fix(es):\n\n* flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-14T06:27:05.72166Z","modified":"2026-10-14T07:00:02.777069995Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-86320","description":"A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.","status":"published","published":"2026-09-17T08:17:00Z","modified":"2026-10-17T13:01:13.617876Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:80495","title":"Important: flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.  \n\nSecurity Fix(es):  \n\n  * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:30:22.714654999Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80496","title":"Important: flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.  \n\nSecurity Fix(es):  \n\n  * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:30:10.333163956Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80973","title":"Important: flatpak-builder security update","description":"Flatpak-builder is a tool for building flatpaks from sources.  \n\nSecurity Fix(es):  \n\n  * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:02:24.856338945Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1792771054","title":"flatpak-builder: Fix of CVE-2026-86320","description":"- CVE-2026-86320: disable git hooks when applying patch sources","status":"published","published":"2026-10-23T15:57:45Z","modified":"2026-10-26T09:31:37.170531916Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0519","title":"Updated flatpak-builder package fixes a security vulnerability","description":"Host code execution via `git am` hook execution in patch source\nextraction (`use-git-am`). (CVE-2026-86320)\n","status":"published","published":"2026-10-19T16:59:00Z","modified":"2026-10-19T17:00:03.803200929Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11845-1","title":"flatpak-builder-1.4.12-1.1 on GA media","description":"These are all security issues fixed in the flatpak-builder-1.4.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-22T00:00:00Z","modified":"2026-09-23T09:15:05.354624434Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}