Skip to content
OpenAdvisories

Package · Alpine

flatpak-builder

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.8
    CVE-2026-86320

    Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

    A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the b…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Alpine
  • High 7.7
    CVE-2022-21682

    flatpak-builder can access files outside the build directory.

    Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have t…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine