{"id":"CVE-2026-94422","aliases":["ALPINE-CVE-2026-94422","ALSA-2026:90522","ALSA-2026:90523","AZL-105923","DEBIAN-CVE-2026-94422","EUVD-2026-91646","GHSA-2cgv-pwcq-wvpq","MGASA-2026-0480","OESA-2026-4640","OESA-2026-4641","OESA-2026-4642","OESA-2026-4643","RLSA-2026:90522","RLSA-2026:90523","UBUNTU-CVE-2026-94422","openSUSE-SU-2026:11913-1"],"status":"published","title":"xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00497,"percentile":0.42958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2026-09-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"xdg-dbus-proxy","fixed_in":["0.1.9-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"xdg-dbus-proxy","fixed_in":["0.1.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"xdg-dbus-proxy","fixed_in":["0.1.5-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xdg-dbus-proxy","fixed_in":["0.1.4-3+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xdg-dbus-proxy","fixed_in":["0.1.6-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xdg-dbus-proxy","fixed_in":["0.1.9-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"xdg-dbus-proxy","fixed_in":["0.1.9-1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xdg-dbus-proxy","fixed_in":["0.1.2-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"xdg-dbus-proxy","fixed_in":["0.1.2-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"xdg-dbus-proxy","fixed_in":["0.1.2-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"xdg-dbus-proxy","fixed_in":["0.1.2-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"xdg-dbus-proxy","fixed_in":["0:0.1.3-1.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"xdg-dbus-proxy","fixed_in":["0:0.1.5-4.el10_2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.6-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.4-3+deb12u2"}]}],"versions":["0.1.4-3","0.1.4-3+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6-1+deb13u3"}]}],"versions":["0.1.6-1","0.1.6-1+deb13u1","0.1.6-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1"}]}],"versions":["0.1.6-1","0.1.6-2","0.1.7-1","0.1.8-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1.mga10"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.3-1.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.5-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.1-1","0.1.2-1","0.1.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.2-2build1","0.1.3-1","0.1.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.5-1","0.1.5-1build1","0.1.5-1build2","0.1.5-1ubuntu0.1","0.1.5-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.7-1","0.1.8-1","0.1.9-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.6-1","0.1.6-2","0.1.7-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xdg-dbus-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1.1"}]}],"bundled":2}],"products":[{"vendor":"fedora","product":"fedora"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-94422","tags":["vendor-advisory","report","advisory"]},{"url":"https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400","tags":["patch","fix"]},{"url":"https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e","tags":["patch","fix"]},{"url":"https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3","tags":["patch","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542235","tags":["issue-tracking","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/5","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00050.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-94422","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90522","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2542235","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90522.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90523","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-90523.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94422","tags":["web","advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94422.json","tags":["advisory"]},{"url":"https://github.com/flatpak/xdg-dbus-proxy","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-94422","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0480.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36369","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/23/5","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00422.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NKG63P7KLUREATNV6YUAI7RWYLCWSR6R/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4640","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4641","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4642","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4643","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90522","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90523","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94422","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94422","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-94422","title":"xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T13:54:10.589Z","modified":"2026-10-24T03:08:12.584Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-91646","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T13:54:10Z","modified":"2026-10-24T03:08:12Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:31.52463Z"}],"nvd":[{"id":"CVE-2026-94422","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T14:17:12.003Z","modified":"2026-10-24T04:18:27.61Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"ALPINE-CVE-2026-94422","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T14:17:12.003Z","modified":"2026-11-03T06:33:06.551514364Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-94422","title":"xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T13:54:10.589Z","modified":"2026-10-28T11:21:41.80787443Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-94422","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T14:17:12.003Z","modified":"2026-10-24T09:47:29.943998281Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"OESA-2026-4640","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nAn incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.(CVE-2026-94422)","status":"published","published":"2026-10-29T09:03:55Z","modified":"2026-10-29T09:15:41.11975093Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4641","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nAn incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.(CVE-2026-94422)","status":"published","published":"2026-10-29T09:03:56Z","modified":"2026-10-29T09:15:42.905666177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4642","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nAn incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.(CVE-2026-94422)","status":"published","published":"2026-10-29T09:03:56Z","modified":"2026-10-29T09:15:41.909737917Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4643","title":"xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\r\n\r\nSecurity Fix(es):\n\nAn incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.(CVE-2026-94422)","status":"published","published":"2026-10-29T09:03:57Z","modified":"2026-10-29T09:15:41.951879112Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RLSA-2026:90522","title":"Important: xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\n\nSecurity Fix(es):\n\n* xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:09.468138Z","modified":"2026-10-29T12:30:02.479921836Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90523","title":"Important: xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.\n\nSecurity Fix(es):\n\n* xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:08:23.381701Z","modified":"2026-10-29T12:30:02.490500835Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-94422","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T14:17:00Z","modified":"2026-10-17T13:01:18.907481216Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"ALSA-2026:90522","title":"Important: xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.  \n\nSecurity Fix(es):  \n\n  * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:32:32.793409859Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90523","title":"Important: xdg-dbus-proxy security update","description":"xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.  \n\nSecurity Fix(es):  \n\n  * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-29T11:31:04.151520069Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-105923","title":"CVE-2026-94422 affecting package xdg-dbus-proxy 0.1.6-2","description":"An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.","status":"published","published":"2026-10-02T14:17:12Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"MGASA-2026-0480","title":"Updated xdg-dbus-proxy package fixes a security vulnerability","description":"Message filtering bypass via reply serial. (CVE-2026-94422)\n","status":"published","published":"2026-10-09T17:00:24Z","modified":"2026-10-09T17:15:03.302997455Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11913-1","title":"xdg-dbus-proxy-0.1.9-1.1 on GA media","description":"These are all security issues fixed in the xdg-dbus-proxy-0.1.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-28T00:00:00Z","modified":"2026-09-29T18:23:22.927334408Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}