CVE-2026-86320 affects flatpak-builder when a patch source uses use-git-am: true. In that condition, the upstream advisory says git am can run a malicious post-applypatch hook in the unsandboxed build-host context. This is a build-pipeline boundary problem—not evidence that every Flatpak application has escaped its runtime sandbox.
What does CVE-2026-86320 affect?
The vulnerable path is specific: flatpak-builder applies a patch source with use-git-am: true, and invokes git am without disabling Git hooks. A malicious source can carry a hook that executes during source extraction, before the application is built.
The upstream advisory lists versions from 0.99.2 through 1.4.10 as affected and 1.4.11 and later as patched. Those are upstream version boundaries; downstream distributions may backport fixes or make different package decisions.
Source: flatpak-builder security advisory GHSA-j5p8-jgjc-f3xv.
Why is this a build-host issue?
The important distinction is where the code runs. The hook executes as part of the build process, while Git is operating on the host that runs flatpak-builder. The Flatpak runtime sandbox is not the boundary protecting that operation.
That means the relevant trust question is whether a build workflow processes untrusted or insufficiently reviewed source material with the affected feature enabled. A finished Flatpak application’s runtime permissions do not, by themselves, describe the security boundary used during its construction.
This is also why the advisory should not be rewritten as a generic “Flatpak sandbox escape.” The cited upstream source describes host code execution through Git hooks in the builder workflow; it does not describe an application escaping its runtime sandbox.
Which Debian releases are listed as vulnerable?
Debian’s current tracker lists Bookworm and Trixie as vulnerable, while Forky is fixed at 1.4.11-1 and Sid is fixed at 1.4.12-2.
| Debian release | Tracker version | Tracker status |
|---|---|---|
| Bookworm | 1.2.3-1 | vulnerable |
| Trixie | 1.4.4-2 | vulnerable |
| Forky | 1.4.11-1 | fixed |
| Sid | 1.4.12-2 | fixed |
The tracker notes [trixie] - flatpak-builder <no-dsa> (Minor issue) and [bookworm] - flatpak-builder <postponed> (Minor issue). These labels are Debian’s release-management status for the cited issue; they are not a statement that the upstream flaw is imaginary or that every local workflow has the same exposure.
Source: Debian’s CVE-2026-86320 tracker, checked 2026-09-20. Check the tracker again before making a current package-status claim because distro data changes.
Who should care about this advisory?
The most relevant readers are teams and individuals who build Flatpak applications, especially when manifests or patch sources come from outside the team’s direct control. The affected feature is the decision boundary—not the mere presence of the flatpak-builder package on a machine.
A workflow that never processes untrusted patch sources with use-git-am: true is not described by the advisory as having the same condition. Conversely, a build host that handles externally supplied sources deserves more scrutiny than a workstation that only builds reviewed, local material. The sources do not provide enough information to classify a particular deployment without inspecting its workflow.
What does the advisory not establish?
CVE-2026-86320 does not, by itself, establish active exploitation, universal exposure, or compromise of every Flatpak application. It also does not turn the upstream fixed version into a universal Debian remediation statement: Debian package status must be read from Debian’s tracker for the release in question.
The upstream advisory rates the issue Low, while the CVE record currently lists a 7.8 High CVSS 3.1 score. Those ratings come from different authorities and should not be silently collapsed into one severity label. The upstream advisory describes mitigation as avoiding use-git-am: true for untrusted manifests, using disposable virtual machines for builds, or updating to a patched version. This article intentionally does not turn those points into an executable upgrade or build-hardening procedure; such operational instructions require environment-specific evidence under TheLinuxForum’s Track B policy.
Sources and freshness
- Upstream flatpak-builder advisory
- Debian Security Tracker: CVE-2026-86320
- CVE Record: CVE-2026-86320
For related boundary analysis, see the Linux vulnerability triage guide, container security-boundary guide, and privilege-boundary guide.