Flatpak 1.19.2 development release addresses multiple security vulnerabilities
Flatpak 1.19.2 is a development pre-release that includes several security fixes to prevent file overwriting, unauthorized deletions, and denial of service attacks.
Summary
The Flatpak project has released 1.19.2, a development pre-release in the 1.19.x series. This update incorporates several security patches from the 1.19.1 cycle, addressing vulnerabilities related to privileged file manipulation, OCI repository authentication, and potential denial of service via process signaling. It also introduces new features like byte-based size listing and a new API for deleting user data.
Security and functional updates in Flatpak 1.19.2
- Security Fixes: Addresses CVE-2026-97024 and CVE-2026-97023 regarding privileged file overwriting and deletion.
- Denial of Service Protection: Prevents apps from sending signals to parent processes outside the sandbox and filters .desktop/.service files against an allowlist.
- Credential Security: Ensures OCI repository authentication tokens are not visible to other users (CVE-2026-97025).
- New API: Added
flatpak_user_data_delete()to allow management UIs to implement data deletion during uninstallation. - Dependency Updates: Updates bubblewrap (0.12.0) and xdg-dbus-proxy (0.1.9) to address their respective vulnerabilities.
Why it matters
As a development release, this prepares the ecosystem for the upcoming 1.20.0 stable branch while hardening the sandbox against malicious application behavior.
Original reference: github.com →