Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-develUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-libs | Jun 20, 2024 | Apr 18, 2024 |
| Alpine Linux | — | Upgrade flatpak | Aug 22, 2024 | Apr 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade flatpakUpgrade flatpak-develUpgrade flatpak-builderUpgrade flatpak-libsUpgrade flatpak-debuginfo | May 16, 2024 | Apr 18, 2024 |
| Amazon_linux_2023 | — | Upgrade flatpak-debugsourceUpgrade flatpak-session-helperUpgrade flatpak-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-libs-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-testsUpgrade flatpak-tests-debuginfo | Feb 17, 2025 | Apr 18, 2024 |
| Centos_linux | — | Upgrade flatpak-libsUpgrade flatpak-develUpgrade flatpak-debuginfoUpgrade flatpakUpgrade flatpak-builder | Jun 19, 2024 | Apr 18, 2024 |
| Debian | — | Upgrade flatpak | Apr 22, 2024 | Apr 18, 2024 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Jun 24, 2024 | Apr 18, 2024 |
| Oracle_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-builderUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-libsUpgrade flatpak-selinux | Jun 18, 2024 | Apr 18, 2024 |
| Redhat_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-libs-debuginfoUpgrade flatpak-builderUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak | Jun 19, 2024 | Apr 18, 2024 |
| Rocky_linux | — | Upgrade flatpak-libs-debuginfoUpgrade flatpak-debuginfoUpgrade flatpak-libsUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-session-helper | Jul 3, 2024 | Apr 18, 2024 |
| Suse | — | Upgrade flatpak-develUpgrade xdg-desktop-portalUpgrade xdg-desktop-portal-langUpgrade system-user-flatpakUpgrade flatpak-remote-flathubUpgrade libflatpak0Upgrade bubblewrap-zsh-completionUpgrade flatpak-selinuxUpgrade flatpak-zsh-completionUpgrade xdg-desktop-portal-devel-docsUpgrade xdg-desktop-portal-develUpgrade typelib-1_0-flatpak-1_0Upgrade wayland-protocols-develUpgrade bubblewrapUpgrade flatpak | May 7, 2024 | Apr 18, 2024 |
| Ubuntu | — | Upgrade flatpak | Nov 19, 2024 | Apr 18, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub