flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

Important: flatpak-builder

Issue Overview: When use-git-am: true is enabled for a patch source, flatpak-builder invokes git am without disabling git hooks. A malicious source can include a post-applypatch hook, which will be executed automatically when a patch with use-git-am: true is applied. Since git itself runs...

DEBIAN-CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320

CVE-2026-86320 affects flatpak-builder , a build tool for creating Flatpak applications. When applying patch sources with use-git-am: true, Git hooks are not disabled, allowing an attacker who supplies a malicious source containing a post-applypatch hook to execute arbitrary code on the host duri...

CVE-2026-86320 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

EUVD-2026-81387

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...