Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-86320: When use-git-am: true is enabled for a patch source, flatpak-builder invokes git am without disabling git hooks. A malicious source can include a post-applypatch hook, which will be executed automatically when a patch with use-git-am: true is applied. Since git itself runs unsandboxed in host context at this stage, the hook is executed with host privileges, allowing arbitrary code execution on the host.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | flatpak-builder | 0:1.4.4-1.amzn2023.0.2 |
| Amazon Linux · 2023 | flatpak-builder-debuginfo | 0:1.4.4-1.amzn2023.0.2 |
| Amazon Linux · 2023 | flatpak-builder-debugsource | 0:1.4.4-1.amzn2023.0.2 |
| Amazon Linux · 2023 | flatpak-builder-tests | 0:1.4.4-1.amzn2023.0.2 |
Vulnerabilities 1
-
High 7.8
Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the b…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-86320.html