CVE-2023-28101 - CVE House
Back to Database
Status published Medium CVE-2023-28101

Flatpak metadata with ANSI control codes can cause misleading terminal output

Vulnerability Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28101

Credits & Attribution

No credits recorded in the NVD database.

References

More from flatpak

View All →
CVE-2024-42472
Flatpak may allow access to files outside sandbox for certain apps
Critical 10
CVE-2024-32462
Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing
High 8.4
CVE-2023-28100
TIOCLINUX can send commands outside sandbox if running on a virtual console
Critical 10
CVE-2022-21682
flatpak-builder can access files outside the build directory.
High 7.7
CVE-2021-43860
Permissions granted to applications can be hidden from the user at install time
High 8.2

Affected Vendor

Affected Software

flatpak
Vulnerable Versions:
< 1.10.8, >= 1.12.0, < 1.12.8, >= 1.14.0, < 1.14.4, >= 1.15.0, < 1.15.4

Timeline

Official Publish: March 16th, 2023
Last Modified: February 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Weaknesses (CWE)

CWE-116

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact