The vulnerability arises from flatpak-builder not disabling Git hooks when applying patch sources using the use-git-am: true option. This allows an attacker who can provide a malicious source containing a Git post-applypatch hook to execute arbitrary code on the host during the build process. The code executes with the privileges of the flatpak-builder process. Exploitation requires the build process to handle attacker-controlled or untrusted sources with this option enabled. The vulnerability is rated with a CVSS 3.1 score of 7.8 (high severity) by Red Hat. Red Hat advises avoiding use-git-am: true on untrusted manifests and recommends isolated build environments for untrusted builds. No official fix or patch status is explicitly stated in the advisory, so patch status is not yet confirmed.

Successful exploitation results in arbitrary code execution with the privileges of the user running flatpak-builder. This can lead to full compromise of data accessible to that user and potentially modification or exfiltration of sensitive information. The vulnerability impacts confidentiality, integrity, and availability of the affected system. Exploitation requires local access to initiate the build process or automated build services processing untrusted manifests.

Red Hat advises avoiding the use of the use-git-am: true option when processing untrusted manifests or source material. For scenarios requiring untrusted builds, it is recommended to perform builds inside disposable virtual machines or other isolated environments to contain potential malicious code execution. No official patch or fix is currently confirmed; users should monitor the Red Hat advisory for updates.