{}

{}

{}

{"acknowledgement": "Upstream acknowledges refi64 as the original reporter.", "bugzilla": {"description": "xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape", "id": "2542235", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542235"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cvss4": {"cvss4_base_score": "8.7", "cvss4_scoring_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "status": "draft"}, "cwe": "CWE-290", "details": ["An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox."], "mitigation": {"lang": "en:us", "value": "Avoid running untrusted Flatpak apps and avoid running untrusted apps via other frameworks that use xdg-dbus-proxy."}, "name": "CVE-2026-94422", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "xdg-dbus-proxy", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "xdg-dbus-proxy", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-23T13:57:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94422\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94422\nhttps://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq"], "statement": "Red Hat's CVSSv3.1 score has been calculated from the upstream-provided CVSSv4 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The resulting CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector reflects a network-exploitable flaw with low attack complexity and no privileges required, but requiring a user (via a malicious/compromised Flatpak app) to interact with the D-Bus session bus. The proxy's failure to validate reply-serial numbers on non-reply messages allows a sandboxed app to bypass its message filter and reach otherwise-blocked D-Bus interfaces, resulting in a full loss of confidentiality, integrity, and availability of the host system outside the sandbox.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.1.9)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "xdg-dbus-proxy", "vendor": "flatpak"}], "created": "2026-09-28T01:30:06.526417+00:00", "updated": "2026-09-28T02:00:18.282423+00:00", "vendors": ["flatpak", "flatpak$PRODUCT$xdg-dbus-proxy"]}