A security vulnerability (CVE-2026-94422) in xdg-dbus-proxy allows a message filtering bypass via reply serial, which can lead to sandbox escape. xdg-dbus-proxy is a filtering proxy for D-Bus connections, originally part of the flatpak project but now a standalone module. This issue has been addressed in version 0.1.5-4.el10_2.1 of the software.