Impact

If an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the flatpak(1) command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ESC.

Patches

• 6cac99d
• 7fe63f2
• 409e341 (only applicable for 1.14.x or newer)

See the flatpak-1.14.x, flatpak-1.12.x, flatpak-1.10.x branches for backports to older codebases.

Workarounds

Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.