GNOME 50.5 security fixes patch a gvfs CVE and Epiphany code injection
GNOME 50.5 patches gvfs CVE-2026-88924, Epiphany JavaScript injection and ZIP-slip extension flaws, plus use-after-free bugs in librsvg and GDM.
GNOME 50.5 shipped September 24 and updates 22 modules, with gvfs 1.60.3 carrying the only CVE identifier, CVE-2026-88924, which fixes socket ownership in the admin backend. Epiphany 50.6 fixes JavaScript code injection via a CSS selector in the autofill feature and a ZIP-slip path traversal in WebExtension XPI files, while 50.5 adds shell command quoting. librsvg 2.62.4 fixes a use-after-free triggered by duplicate XML entities in nested XInclude documents, and GDM 50.3 fixes two use-after-frees, one able to crash the session during screen lock or unlock.
- CVE-2026-88924 fixed in gvfs 1.60.3; admin backend now sets socket ownership before creation.
- Epiphany 50.6 patches autofill JavaScript injection and ZIP-slip path traversal in WebExtension XPI packages.
- librsvg 2.62.4 fixes use-after-free from duplicate XML entities; GDM 50.3 fixes two use-after-frees.
- Distributions shipping GNOME 50 must push packages for users to receive the fixes.
- CVEs
- CVE-2026-88924
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88924 | TOCTOU symlink race in gvfs gvfsd-admin daemon allows local privilege escalation to root | 7.0 | — |
From the original article
2 min read at helpnetsecurity.com
GNOME 50. 5, which the GNOME Release Team shipped on September 24, patches a CVE in the gvfs file system layer, a JavaScript injection flaw in the Epiphany web browser and a use-after-free bug in the librsvg image library. The release updates 22 modules.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.