Executive brief
flatpak-builder is a tool used to build Flatpak applications (containerized Linux desktop applications). When the use-git-am option is enabled, Git hooks from malicious source patches are not properly disabled, allowing an attacker to execute arbitrary code on the build host with the privileges of the user running flatpak-builder. This could compromise the integrity of built applications and the build system itself.
Technical details
The vulnerability is a code injection flaw (CWE-94) in flatpak-builder's patch source handling. When use-git-am is set to true, the tool applies patches using Git's apply-patch functionality but fails to disable Git hooks (specifically post-applypatch hooks) that may be embedded in a malicious source. An attacker can craft a malicious source repository containing a Git post-applypatch hook that executes during the build process. Attack requires the build process to process an attacker-controlled or untrusted source with use-git-am enabled; interactive builds require user interaction to initiate the build, while automated CI/CD systems processing untrusted manifests may be exploited without additional user interaction. Successful exploitation results in arbitrary code execution with the privileges of the flatpak-builder process, potentially allowing access to or modification of build artifacts and system data.
Affected products
- Flatpak flatpak-builder
Timeline
- 2026-09-17: disclosed