CVE-2026-86320

Name of the Vulnerable Software and Affected Versions flatpak-builder (affected versions not specified)

Description A flaw exists where Git hooks are not disabled when applying patch sources with use-git-am set to true. An attacker providing a malicious source containing a Git post-applypatch hook can trigger the execution of that hook on the host during the build process. This leads to arbitrary code execution with the privileges of the user running flatpak-builder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.