GNOME 50.5 security fixes patch a gvfs CVE and Epiphany code injection

GNOME 50.5, which the GNOME Release Team shipped on September 24, patches a CVE in the gvfs file system layer, a JavaScript injection flaw in the Epiphany web browser and a use-after-free bug in the librsvg image library.

GNOME 50.5

The release updates 22 modules. Users who browse with Epiphany, view SVG images through librsvg or reach files through gvfs keep these flaws until their distribution ships the new packages. “All operating systems shipping GNOME 50 are encouraged to upgrade,” the team wrote.

Epiphany closes a ZIP slip hole

Epiphany jumps from 50.4 to 50.6 in this release, picking up two August versions. Version 50.6, dated August 13, fixes JavaScript code injection through a CSS selector in the autofill feature and a path traversal flaw in WebExtension XPI files, labeled ZIPSLIP. In a ZIP slip attack, a crafted archive writes files outside the folder meant to hold it, so a malicious extension package could place files elsewhere on disk. Version 50.5 adds quoting to command line input before Epiphany hands it to a shell. The two versions also fix crashes in the password manager and on invalid bookmark imports.

One CVE, one line

gvfs 1.60.3 carries the only CVE identifier in the release notes, CVE-2026-88924. The fix makes the admin backend set ownership on its socket before creating it. The changelog gives that one line and no severity score, which leaves administrators to judge the risk from a single entry.

Memory bugs in images and the login screen

librsvg 2.62.4 fixes a use-after-free, a bug where a program keeps using memory it has already released. Duplicate XML entities in nested XInclude documents triggered it. The librsvg release also updates two Rust dependencies for advisories RUSTSEC-2026-0187 and RUSTSEC-2026-0204.

GDM 50.3, the login manager, fixes two use-after-free bugs, one of which could crash the whole user session during screen lock or unlock. It also repairs a regression in which an earlier security fix broke authentication on systemd. GNOME Shell 50.5 now refuses to unlock the screen after a screen time limit is reached, cancels mount password dialogs when the screen locks, and validates serialized image data before creating a pixbuf.

Two more libraries harden their file handling. libgsf 1.14.59 guards its OLE2 loader against runaway recursion and fixes zip reads on corrupted streams, and libsecret’s file backend gains file locking to stop concurrent writes from racing.