CVE-2023-28101
flatpak: Metadata with ANSI control codes can cause misleading terminal output
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 16, 2023
Updated · November 22, 2025
Description
A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Suppose an attacker publishes a Flatpak app with elevated permissions. In that case, they can hide those permissions from users of the flatpak(1) command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ESC.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
CVSS / CWE
CVSS 3.1 · 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-116 · Improper Encoding or Escaping of Output