High severity7.8NVD Advisory· Published Sep 17, 2026· Updated Oct 30, 2026
CVE-2026-86320
CVE-2026-86320
Description
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versions
< 1.4.12-1.1+ 1 more
- (no CPE)range: < 1.4.12-1.1
- (no CPE)range: < 1.4.4-1.el10_2.1
Patches
Vulnerability mechanics
References
13- access.redhat.com/errata/RHSA-2026:80495nvd
- access.redhat.com/errata/RHSA-2026:80496nvd
- access.redhat.com/errata/RHSA-2026:80973nvd
- access.redhat.com/errata/RHSA-2026:84832nvd
- access.redhat.com/errata/RHSA-2026:84833nvd
- access.redhat.com/errata/RHSA-2026:84834nvd
- access.redhat.com/errata/RHSA-2026:84842nvd
- access.redhat.com/errata/RHSA-2026:86714nvd
- access.redhat.com/errata/RHSA-2026:90896nvd
- access.redhat.com/errata/RHSA-2026:92220nvd
- access.redhat.com/security/cve/CVE-2026-86320nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xvnvd
News mentions
0No linked articles in our index yet.