Updated flatpak-builder package fixes a security vulnerability
Publication date: 19 Oct 2026Modification date: 19 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-86320
Description
Host code execution via `git am` hook execution in patch source
extraction (`use-git-am`). (CVE-2026-86320)
References
- https://bugs.mageia.org/show_bug.cgi?id=36407
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BJF2ORPRVKVTXPAFIDS6U5SNJHW6VTMX/
- https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-j5p8-jgjc-f3xv
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJHPETQUQKC4Z7Z3LWM37VPXNFDJHFGB/
- https://www.cve.org/CVERecord?id=CVE-2026-86320
SRPMS
10/core
- flatpak-builder-1.4.12-1.mga10