CVE-2026-86320

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 17, 2026
Last modified: Oct 21, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-863215.3A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file sr CVE-2026-863259.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insuff CVE-2026-863268.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify th CVE-2026-86339.8IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Appli CVE-2026-863307.2An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible CVE-2026-863326.5A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes CVE-2026-863344.2Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on CVE-2026-863356.3Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to acces CVE-2026-863386.0Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced i CVE-2026-86349.1Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or comprom CVE-2026-863414.4GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that,CVE-2026-863424.3Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlatio