CVE-2021-21381

A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity.

This is essentially a sandbox escape flaw and needs a malicious app publisher to execute the exploit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/.desktop (typically ~/.local/share/flatpak/exports/share/applications/.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.