CyberRota Analysis
AI-GeneratedA vulnerability exists in flatpak-builder due to Git hooks not being disabled when applying patch sources, potentially allowing an attacker to execute malicious code during the build process. This could lead to arbitrary code execution with the privileges of the user running flatpak-builder. Developers and organizations using flatpak-builder should prioritize addressing this issue to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.