Skip to content

Security Advisory 2026-10-22

In Dangerzone, two security vulnerabilities were found in the way the Dangerzone sandbox is updated on computers that are not connected to the internet. These vulnerabilities do not affect the way Dangerzone converts documents, and most users are not affected. All users are advised to update Dangerzone to the latest version, especially those who update the Dangerzone sandbox manually on an offline computer.

Summary

Dangerzone converts documents inside a sandbox, which we update regularly. Usually, Dangerzone downloads sandbox updates automatically from the internet. Users with offline (air-gapped) computers can instead prepare a sandbox update on a computer that is connected to the internet, transfer it to their offline computer as a single file (an archive), and install it there with the dangerzone-image load-archive command.

Before installing a sandbox update, Dangerzone checks that it was created by us. An internal security assessment found two issues with how Dangerzone handled these archives:

  • GHSA-m282-wfqf-935m: A malicious archive could make Dangerzone create or overwrite a file anywhere on your computer that you have access to. This would happen while Dangerzone was checking the archive and before it rejected it.
  • GHSA-pfm5-gp85-8g5p: Dangerzone passed the archive to Podman, the program that runs the sandbox, before checking that it was created by us. We are not aware of a way to exploit this, but it unnecessarily exposed Podman to untrusted files.

How does this impact me?

You are only affected if you install sandbox updates with the dangerzone-image load-archive command, and you load an archive that you did not prepare yourself or that someone may have tampered with before it reached you.

If you install sandbox updates when Dangerzone prompts you, or if you only update Dangerzone itself, you are not affected. Converting documents with Dangerzone is not affected in any case.

If you are running Dangerzone via Qubes OS, you are not affected.

What do I need to do?

All users are advised to update their Dangerzone installation to 0.11.1. If you install sandbox updates with the dangerzone-image load-archive command, you are advised to update as soon as possible.

Even after updating, you are strongly advised to load only archives that you have prepared yourself with dangerzone-image prepare-archive and to never load archives that you don't trust, as described in our documentation.