Executive brief
xdg-dbus-proxy is a tool used to filter and secure communications between different applications on a Linux system, commonly used within Flatpak environments. A flaw in how it processes security rules allows a malicious or compromised application to bypass restrictions and 'eavesdrop' on private system messages. This could lead to the unauthorized interception of sensitive data being exchanged between other running programs.
Technical details
A vulnerability exists in the policy parser of xdg-dbus-proxy due to improper validation of unsafe equivalence in input (CWE-1289). The proxy specifically checks for the string 'eavesdrop=true' in policy rules but fails to account for variations such as 'eavesdrop = \'true\'' (containing spaces or different quoting). A local attacker, typically a malicious or compromised Flatpak application, can exploit this parsing inconsistency to bypass eavesdropping restrictions. This allows the attacker to monitor and intercept D-Bus messages on the session bus that should be restricted. The issue is resolved in version 0.1.7.
Affected products
- flatpak xdg-dbus-proxy < 0.1.7
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory: Vendor advisory published by Flatpak
- 2026-04-07: patched: Fixed in version 0.1.7
- 2026-04-21: advisory: Debian LTS advisory DLA-4542-1 published