Flatpak – An Insecurity Nightmare

A security researcher has discovered a vulnerability in the Flatpak Linux application sandboxing framework, which could allow an attacker to escape the sandbox and gain elevated privileges. The vulnerability, discovered by researcher Alexander Færøy, affects Flatpak versions 1.10.4 and earlier. It was discovered that the `flatpak-builder` tool does not properly validate the `--url` argument, allowing an attacker to inject malicious code. This could lead to an escalation of privileges, potentially allowing an attacker to gain root access.