CVE-2026-86320— Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 flatpak-builder 中发现了一个漏洞：当使用 应用补丁源时，Git hooks（钩子）未被禁用。能够提供一个包含恶意 Git 钩子的源的攻击者，可以在构建过程中触发该钩子在主机上执行，从而以运行 flatpak-builder 的用户权限实现任意代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86320
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-86320
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86320
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86320 (1)
Other References for CVE-2026-86320 (2)
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2025-11395
Podman: arbitrary file write when importing oci archive -
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-85013
Environment-modules: command injection in environment-module -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc -
CVE-2026-90996
Sssd: sssd: denial of service in nss responder via crafted z
Same vendor: Red Hat
-
CVE-2026-85469
Quay-builder-qemu: quay-builder-qemu: release workflow uses -
CVE-2026-42784
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity co -
CVE-2026-19607
Keycloak-services: keycloak-services: broker-originated user -
CVE-2026-17526
Keycloak-services: keycloak-services: privilege escalation v -
CVE-2026-92615
Flightctl: flightctl: package-global go-git https transport
Same weakness: CWE-94
-
CVE-2026-92593
Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Ex -
CVE-2026-92784
@refinedev/inferencer through 7.0.0 Code Injection via API F -
CVE-2026-89083
HP Advance – Potential Elevation of Privilege, Remote Code E -
CVE-2026-89082
HP Advance – Potential Elevation of Privilege, Remote Code E -
CVE-2026-63325
Redocly CLI: Arbitrary code execution via Arazzo `$faker` ex
V. Comments for CVE-2026-86320
No comments yet