Proton Pass

Encrypted password manager

Proton Pass desktop is the official Linux application for the Proton Pass password manager. This Flatpak wraps the official Linux RPM with zypak. It is not a vendor-official Flatpak and not the community Flathub wrapper.

Proton Pass is proprietary freeware; this Flatpak is a redistribution of the official RPM, not vendor official.

passwordpassprotonencrypted

Vault and search
Vault and search
Hide-my-email alias
Hide-my-email alias

Install

flatpak --user remote-add --if-not-exists thepeoples \
  https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.ProtonPass
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.42.0

Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.

Previous versions

The remote keeps the current tree plus the last two vendor versions as extra ostree branches for rollback. Objects stay on the remote after a branch is dropped (publish does not delete).

  • Version 1.39.1 (ostree 7a81ead4e548dd69b1157f993ef2ba8f63e5a7343504e10f0e62a75ffb5c5120)
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.39.1
  • Version 1.40.0 (ostree 6fd8a3293ddf2ab3fa6bb709889a1fb2a0eac30bca89bd1e6979283d9fbcf2ee)
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.40.0

Verify

  • App id io.thepeoples.ProtonPass, vendor Proton AG, version 1.42.0, license proprietary
  • Download 151.9 MB · installed 393.6 MB
  • sha256 aa888e2d6e1e63cf13b9ab777e20302647ea38e19fa9a55a7dafb7f91ce25ae1
  • sha512 8b5523a6da4d29eb75c8d271911fac37e0b9e4acc1b8eacbd5c2a2797b99f5c2927bd0444f55f45359fe9feee2778639201dd2bd548876b7383775ac1f1a7582 (official source, checked after download from https://proton.me/download/pass/linux/version.json)
  • Ostree key fingerprint 98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841
  • Homepage https://proton.me/pass

Input scan

Pinned rpm proton-pass-1.42.0-1.x86_64.rpm, extracted without install scripts, scanned before wrap. 2026-10-14 19:38 UTC · trivy 0.73.0 · vuln DB 2026-10-14.

Wrap

Layers this remote adds. Gate fails on CRITICAL.

none

gate pass

Vendor

In the upstream package. Not patched here.

4 HIGH

Vendor findings 4 · 4 HIGH
SeverityIDPackageInstalledFixedTitle
HIGHCVE-2026-102673electron39.8.1041.10.4, 42.5.2, 43.0.0electron: Electron: Sandbox bypass via popups opened from sandboxed iframes
HIGHCVE-2026-102674electron39.8.1041.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5electron: Electron: Sandbox bypass via popup window creation
HIGHCVE-2026-102675electron39.8.1041.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers
HIGHCVE-2026-102676electron39.8.1041.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5electron: electron: Privilege escalation via unauthorized Node.js integration in web workers

Full report (JSON)

Previous scans

Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.

ScannedVuln DBVersionWrapVendorReport
2026-10-14 06:51 UTC2026-10-141.42.0none4 HIGHJSON
2026-10-13 06:57 UTC2026-10-131.42.0none4 HIGHJSON
2026-10-12 09:28 UTC2026-10-121.42.0none4 HIGHJSON
2026-10-12 06:51 UTC2026-10-121.42.0none4 HIGHJSON
2026-10-11 06:52 UTC2026-10-111.42.0none4 HIGHJSON
2026-10-10 06:51 UTC2026-10-101.42.0none4 HIGHJSON
2026-10-09 06:51 UTC2026-10-081.42.0none4 HIGHJSON
2026-10-08 19:31 UTC2026-10-081.42.0none4 HIGHJSON
2026-10-08 06:51 UTC2026-10-071.41.1none4 HIGHJSON
2026-10-07 06:51 UTC2026-10-071.41.1none4 HIGHJSON
2026-10-06 06:51 UTC2026-10-061.41.1none4 HIGHJSON
2026-09-27 07:34 UTC2026-09-271.41.1nonenoneJSON
2026-09-27 06:52 UTC2026-09-271.41.1nonenoneJSON
2026-09-26 07:08 UTC2026-09-261.41.1nonenoneJSON