ChatGPT Desktop

ChatGPT desktop for Linux (preview)

preview

ChatGPT Desktop uses an independently maintained Flatpak wrapper. The proprietary Linux package is downloaded directly from its vendor during installation; this remote does not redistribute the app binaries.

Proprietary application; wrapper-only extra-data delivery. Not vendor official. No binary redistribution right is claimed.

The application downloads directly from its vendor during installation. The signed remote supplies its wrapper and pinned download identity.

chatgptopenaidesktop

Install

flatpak --user remote-add --if-not-exists thepeoples \
  https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.ChatGPT
flatpak --user install -y thepeoples io.thepeoples.ChatGPT//26.1103.60933

Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.

Verify

App id io.thepeoples.ChatGPT, vendor OpenAI, version 26.1103.60933, license proprietary
Channel preview
Download 565.8 MB · installed 8.9 MB
sha256 0746e9ba575182f5dbe32617b82a645eb93ad57ca588e5a9358695a6b65aee71
Ostree key fingerprint 98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841
Vendor key fingerprint 3BFA0E4AE8B8CC16A2D9BA684A3B4A566C4660E4
Homepage https://learn.chatgpt.com/docs/linux/linux-app

Input scan

Pinned deb chatgpt_26.1103.60933_amd64.deb, extracted without install scripts, scanned before wrap. 2026-11-10 23:17 UTC · trivy 0.73.0 · vuln DB 2026-11-10.

Wrap

Layers this remote adds. Gate fails on CRITICAL.

none

gate pass

Vendor

In the upstream package. Not patched here.

25 HIGH · 51 MEDIUM · 18 LOW

Vendor findings 94 · 25 HIGH · 51 MEDIUM · 18 LOW

Severity	ID	Package	Installed	Fixed	Title
HIGH	`CVE-2026-102673`	`electron`	33.2.1	41.10.4, 42.5.2, 43.0.0	electron: Electron: Sandbox bypass via popups opened from sandboxed iframes
HIGH	`CVE-2026-102673`	`electron`	35.2.0	41.10.4, 42.5.2, 43.0.0	electron: Electron: Sandbox bypass via popups opened from sandboxed iframes
HIGH	`CVE-2026-102674`	`electron`	33.2.1	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5	electron: Electron: Sandbox bypass via popup window creation
HIGH	`CVE-2026-102674`	`electron`	35.2.0	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5	electron: Electron: Sandbox bypass via popup window creation
HIGH	`CVE-2026-102675`	`electron`	33.2.1	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5	electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers
HIGH	`CVE-2026-102675`	`electron`	35.2.0	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5	electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers
HIGH	`CVE-2026-102676`	`electron`	33.2.1	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5	electron: electron: Privilege escalation via unauthorized Node.js integration in web workers
HIGH	`CVE-2026-102676`	`electron`	35.2.0	41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5	electron: electron: Privilege escalation via unauthorized Node.js integration in web workers
HIGH	`CVE-2026-115570`	`electron`	33.2.1	45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16	electron: Electron: TLS server impersonation via compromised intermediate certificates
HIGH	`CVE-2026-115570`	`electron`	35.2.0	45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16	electron: Electron: TLS server impersonation via compromised intermediate certificates
HIGH	`CVE-2026-34769`	`electron`	33.2.1	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8	Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches
HIGH	`CVE-2026-34769`	`electron`	35.2.0	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8	Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches
HIGH	`CVE-2026-34770`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8	Electron: Use-after-free in PowerMonitor on Windows and macOS
HIGH	`CVE-2026-34770`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8	Electron: Use-after-free in PowerMonitor on Windows and macOS
HIGH	`CVE-2026-34771`	`electron`	33.2.1	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8	electron: Electron: Memory corruption or application crash via use-after-free in permission request handling
HIGH	`CVE-2026-34771`	`electron`	35.2.0	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8	electron: Electron: Memory corruption or application crash via use-after-free in permission request handling
HIGH	`CVE-2026-34774`	`electron`	33.2.1	39.8.1, 40.7.0, 41.0.0	Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering
HIGH	`CVE-2026-34774`	`electron`	35.2.0	39.8.1, 40.7.0, 41.0.0	Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering
HIGH	`CVE-2026-70601`	`electron`	33.2.1	39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5	Electron: Context isolation bypass via Function.prototype.bind hijack
HIGH	`CVE-2026-70601`	`electron`	35.2.0	39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5	Electron: Context isolation bypass via Function.prototype.bind hijack
HIGH	`CVE-2026-70604`	`electron`	33.2.1	42.0.0, 41.4.0, 40.9.3, 39.8.10	Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
HIGH	`CVE-2026-70604`	`electron`	35.2.0	42.0.0, 41.4.0, 40.9.3, 39.8.10	Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
HIGH	`CVE-2026-70608`	`electron`	33.2.1	42.0.1, 41.10.3, 39.8.10	Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
HIGH	`CVE-2026-70608`	`electron`	35.2.0	42.0.1, 41.10.3, 39.8.10	Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
HIGH	`CVE-2026-33671`	`picomatch`	4.0.3	4.0.4, 3.0.2, 2.3.2	picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns
MEDIUM	`CVE-2025-55305`	`electron`	33.2.1	35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6	electron: ASAR Integrity Bypass via resource modification
MEDIUM	`CVE-2025-55305`	`electron`	35.2.0	35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6	electron: ASAR Integrity Bypass via resource modification
MEDIUM	`CVE-2026-102672`	`electron`	33.2.1	39.8.10, 41.10.5, 42.0.0-beta.2	electron: Electron: Arbitrary file overwrite via race condition in ShipIt update helper
MEDIUM	`CVE-2026-102672`	`electron`	35.2.0	39.8.10, 41.10.5, 42.0.0-beta.2	electron: Electron: Arbitrary file overwrite via race condition in ShipIt update helper
MEDIUM	`CVE-2026-113796`	`electron`	33.2.1	45.0.0-alpha.6, 44.3.0, 43.7.0, 42.11.3	electron: electron: SameSite cookie bypass via incorrect navigation initiator handling
MEDIUM	`CVE-2026-113796`	`electron`	35.2.0	45.0.0-alpha.6, 44.3.0, 43.7.0, 42.11.3	electron: electron: SameSite cookie bypass via incorrect navigation initiator handling
MEDIUM	`CVE-2026-113798`	`electron`	33.2.1	45.0.0-alpha.13, 44.5.0, 43.7.6, 42.11.9	electron: Electron: Unauthorized pointer lock permission grant via cross-origin iframes
MEDIUM	`CVE-2026-113798`	`electron`	35.2.0	45.0.0-alpha.13, 44.5.0, 43.7.6, 42.11.9	electron: Electron: Unauthorized pointer lock permission grant via cross-origin iframes
MEDIUM	`CVE-2026-113800`	`electron`	33.2.1	45.0.0-alpha.5, 44.3.0, 43.7.0, 42.11.3	electron: electron: Unauthorized device access via incorrect frame origin validation
MEDIUM	`CVE-2026-113800`	`electron`	35.2.0	45.0.0-alpha.5, 44.3.0, 43.7.0, 42.11.3	electron: electron: Unauthorized device access via incorrect frame origin validation
MEDIUM	`CVE-2026-114121`	`electron`	33.2.1	42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5	electron: Electron: Unauthorized application launch via external protocol URL misattribution
MEDIUM	`CVE-2026-114121`	`electron`	35.2.0	42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5	electron: Electron: Unauthorized application launch via external protocol URL misattribution
MEDIUM	`CVE-2026-34765`	`electron`	33.2.1	39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5	electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling
MEDIUM	`CVE-2026-34765`	`electron`	35.2.0	39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5	electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling
MEDIUM	`CVE-2026-34767`	`electron`	33.2.1	38.8.6, 39.8.3, 40.8.3, 41.0.3	electron: Electron: HTTP Response Header Injection via attacker-controlled input
MEDIUM	`CVE-2026-34767`	`electron`	35.2.0	38.8.6, 39.8.3, 40.8.3, 41.0.3	electron: Electron: HTTP Response Header Injection via attacker-controlled input
MEDIUM	`CVE-2026-34772`	`electron`	33.2.1	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7	Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash
MEDIUM	`CVE-2026-34772`	`electron`	35.2.0	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7	Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash
MEDIUM	`CVE-2026-34773`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.1, 41.0.0	electron: Electron: Protocol handler hijacking via improper validation of protocol names
MEDIUM	`CVE-2026-34773`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.1, 41.0.0	electron: Electron: Protocol handler hijacking via improper validation of protocol names
MEDIUM	`CVE-2026-34775`	`electron`	33.2.1	38.8.6, 39.8.4, 40.8.4, 41.0.0	Electron: Electron: Arbitrary code execution and information disclosure due to incorrect Node.js integration scoping
MEDIUM	`CVE-2026-34775`	`electron`	35.2.0	38.8.6, 39.8.4, 40.8.4, 41.0.0	Electron: Electron: Arbitrary code execution and information disclosure due to incorrect Node.js integration scoping
MEDIUM	`CVE-2026-34776`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.1, 41.0.0	Electron: Electron: Information disclosure via crafted second-instance message
MEDIUM	`CVE-2026-34776`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.1, 41.0.0	Electron: Electron: Information disclosure via crafted second-instance message
MEDIUM	`CVE-2026-34777`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.1, 41.0.0	Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin
MEDIUM	`CVE-2026-34777`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.1, 41.0.0	Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin
MEDIUM	`CVE-2026-34778`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.1, 41.0.0	Electron: Electron: Integrity issue due to IPC channel spoofing by a service worker
MEDIUM	`CVE-2026-34778`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.1, 41.0.0	Electron: Electron: Integrity issue due to IPC channel spoofing by a service worker
MEDIUM	`CVE-2026-34779`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8	Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
MEDIUM	`CVE-2026-34779`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8	Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
MEDIUM	`CVE-2026-70597`	`electron`	33.2.1	39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3	Electron: Parent process code-sign check is spoofable
MEDIUM	`CVE-2026-70597`	`electron`	35.2.0	39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3	Electron: Parent process code-sign check is spoofable
MEDIUM	`CVE-2026-70599`	`electron`	33.2.1	39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1	Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
MEDIUM	`CVE-2026-70599`	`electron`	35.2.0	39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1	Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
MEDIUM	`CVE-2026-70602`	`electron`	33.2.1	39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: Extension tab APIs operate across session boundaries
MEDIUM	`CVE-2026-70602`	`electron`	35.2.0	39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: Extension tab APIs operate across session boundaries
MEDIUM	`CVE-2026-70603`	`electron`	33.2.1	42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6	Electron: shell.openPath path validation bypass via embedded null byte
MEDIUM	`CVE-2026-70603`	`electron`	35.2.0	42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6	Electron: shell.openPath path validation bypass via embedded null byte
MEDIUM	`CVE-2026-70605`	`electron`	33.2.1	39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3	Electron: HTTP redirect followed into local file loader
MEDIUM	`CVE-2026-70605`	`electron`	35.2.0	39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3	Electron: HTTP redirect followed into local file loader
MEDIUM	`CVE-2026-70607`	`electron`	33.2.1	39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: window.open features string controls some window options considered privileged
MEDIUM	`CVE-2026-70607`	`electron`	35.2.0	39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: window.open features string controls some window options considered privileged
MEDIUM	`CVE-2026-70609`	`electron`	33.2.1	39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1	Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
MEDIUM	`CVE-2026-70609`	`electron`	35.2.0	39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1	Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
MEDIUM	`CVE-2026-70610`	`electron`	33.2.1	39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4	Electron: contextBridge object copy honors prototype setters
MEDIUM	`CVE-2026-70610`	`electron`	35.2.0	39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4	Electron: contextBridge object copy honors prototype setters
MEDIUM	`CVE-2026-70611`	`electron`	33.2.1	39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3	Electron: DevTools embedder handler executes arbitrary files via shell open
MEDIUM	`CVE-2026-70611`	`electron`	35.2.0	39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3	Electron: DevTools embedder handler executes arbitrary files via shell open
MEDIUM	`CVE-2026-70612`	`electron`	33.2.1	39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: Sandboxed iframes can launch external protocol handlers
MEDIUM	`CVE-2026-70612`	`electron`	35.2.0	39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: Sandboxed iframes can launch external protocol handlers
MEDIUM	`CVE-2026-33672`	`picomatch`	4.0.3	4.0.4, 3.0.2, 2.3.2	picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions
LOW	`CVE-2026-113797`	`electron`	33.2.1	45.0.0-alpha.4, 44.1.1, 43.5.1, 42.11.1	electron: Electron: Information disclosure via improper permission validation in tab queries
LOW	`CVE-2026-113797`	`electron`	35.2.0	45.0.0-alpha.4, 44.1.1, 43.5.1, 42.11.1	electron: Electron: Information disclosure via improper permission validation in tab queries
LOW	`CVE-2026-114122`	`electron`	33.2.1	42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9	electron: Electron: Information disclosure via inconsistent GPU frame geometry
LOW	`CVE-2026-114122`	`electron`	35.2.0	42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9	electron: Electron: Information disclosure via inconsistent GPU frame geometry
LOW	`CVE-2026-114124`	`electron`	33.2.1	42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9	electron: electron: Information disclosure via inconsistent GPU frame geometry
LOW	`CVE-2026-114124`	`electron`	35.2.0	42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9	electron: electron: Information disclosure via inconsistent GPU frame geometry
LOW	`CVE-2026-34764`	`electron`	33.2.1	39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5	Electron: Electron: Memory corruption or crash due to use-after-free in offscreen rendering with shared textures.
LOW	`CVE-2026-34764`	`electron`	35.2.0	39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5	Electron: Electron: Memory corruption or crash due to use-after-free in offscreen rendering with shared textures.
LOW	`CVE-2026-34766`	`electron`	33.2.1	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8	Electron: Electron: Unauthorized USB device access via select-usb-device event callback validation bypass
LOW	`CVE-2026-34766`	`electron`	35.2.0	38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8	Electron: Electron: Unauthorized USB device access via select-usb-device event callback validation bypass
LOW	`CVE-2026-34768`	`electron`	33.2.1	38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8	electron: Electron: Arbitrary code execution via unquoted path in Run registry key
LOW	`CVE-2026-34768`	`electron`	35.2.0	38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8	electron: Electron: Arbitrary code execution via unquoted path in Run registry key
LOW	`CVE-2026-34781`	`electron`	33.2.1	39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5	Electron: Electron: Denial of Service via malformed clipboard image data
LOW	`CVE-2026-34781`	`electron`	35.2.0	39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5	Electron: Electron: Denial of Service via malformed clipboard image data
LOW	`CVE-2026-70598`	`electron`	33.2.1	39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
LOW	`CVE-2026-70598`	`electron`	35.2.0	39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3	Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size
LOW	`CVE-2026-70600`	`electron`	33.2.1	39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3	Electron: Cross-origin iframe can position native autofill popup
LOW	`CVE-2026-70600`	`electron`	35.2.0	39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3	Electron: Cross-origin iframe can position native autofill popup

Full report (JSON)

Previous scans

Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.

Scanned	Vuln DB	Version	Wrap	Vendor	Report
2026-11-10 22:58 UTC	2026-11-10	`26.1103.60933`	none	25 HIGH · 51 MEDIUM · 18 LOW	JSON
2026-11-10 22:16 UTC	2026-11-10	`26.1103.60933`	none	25 HIGH · 51 MEDIUM · 18 LOW	JSON