Threats tagged 'oesa-2026-4074'

A security vulnerability (CVE-2026-86320) exists in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am enabled. This flaw allows an attacker who can supply a malicious source containing a Git post-applypatch hook to execute arbitrary code on the host with the privileges of the user running flatpak-builder. The issue affects multiple versions of flatpak-builder on Red Hat Enterprise Linux 8. A security update is available to address this vulnerability.