CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

Red Hat Product Security has rated this flaw as having an Important security impact. The vulnerability allows a malicious source to execute arbitrary code on the host when processed by flatpak-builder with use-git-am: true. Exploitation requires the target build process to process an attacker-controlled or otherwise untrusted source using this option. In typical interactive builds, user interaction is required to initiate the build, while automated build services that process untrusted manifests may be exposed without additional user interaction. Successful exploitation provides code execution with the privileges of the flatpak-builder process and may allow access to or modification of data available to that process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using use-git-am: true when processing untrusted manifests or source material. Where untrusted builds are required, perform builds inside disposable virtual machines or other isolated environments.