xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

Exact source revision recorded 24 Oct 2026 04:48:20 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-94422

Published

xdg-dbus-proxy

https://github.com/flatpak/xdg-dbus-proxy

Original vendor version evidence · not evaluated as a NuGet range

{
                    "packageName": "xdg-dbus-proxy",
                    "collectionURL": "https://github.com/flatpak/xdg-dbus-proxy",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "lessThan": "0.1.9",
                            "versionType": "semver",
                            "status": "affected"
                        }
                    ]
                }

xdg-dbus-proxy

https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Fedora",
                    "product": "Fedora",
                    "packageName": "xdg-dbus-proxy",
                    "collectionURL": "https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "lessThan": "0.1.9",
                            "versionType": "semver",
                            "status": "affected"
                        }
                    ]
                }

xdg-dbus-proxy

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "packageName": "xdg-dbus-proxy",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:9"
                    ]
                }

xdg-dbus-proxy

https://access.redhat.com/downloads/content/package-browser/

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "packageName": "xdg-dbus-proxy",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10"
                    ]
                }