xdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape
CVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
xdg-dbus-proxy 0.1.9 fixes CVE-2026-94422, a message-filtering flaw that could let a malicious or compromised Flatpak app escape its sandbox and run arbitrary code on the host.
The proxy is meant to sit on the sandbox boundary and restrict which D-Bus session bus traffic an app may send or receive. Before 0.1.9, an incorrect filter allowed an attacker to bypass those rules by attaching a reply serial number to messages that were not replies. All earlier releases are affected.
Although built for Flatpak, xdg-dbus-proxy ships as a separate project and is also used by other isolation frameworks such as Firejail. Any setup that relies on it the same way inherits the same risk until the proxy is updated.
Simon McVittie of Collabora and Debian announced the release. The issue was reported by refi64. The practical mitigation is to avoid untrusted apps run through Flatpak or any other framework that depends on the vulnerable proxy, and to upgrade to 0.1.9.