/flatpak/proton-pass/
Proton Pass
Encrypted password manager
Proton Pass desktop is the official Linux application for the Proton Pass password manager. This Flatpak wraps the official Linux RPM with zypak. It is not a vendor-official Flatpak and not the community Flathub wrapper.
Proton Pass is proprietary freeware; this Flatpak is a redistribution of the official RPM, not vendor official.
Install
flatpak --user remote-add --if-not-exists thepeoples \
https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.ProtonPass
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.39.1Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.
Verify
- App id
io.thepeoples.ProtonPass, vendor Proton AG, version1.39.1, license proprietary - Download 150.5 MB · installed 389.5 MB
- sha256
36913664a32cc2e356242f7369e1f4733495538625162d74c80e82e0c034cfc5 - sha512
3564444f06088afb0992f0b7488e70249ab47799d276c2c5be1db6ba2545b0ace320b3fb65272e415ef8667d4a5207527d8f61ec59a80fe4ad3e81905df9da99(official source, checked after download fromhttps://proton.me/download/pass/linux/version.json) - Ostree key fingerprint
98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841 - Homepage https://proton.me/pass
Input scan
Pinned rpm proton-pass-1.39.1-1.x86_64.rpm, extracted without install scripts, scanned before wrap. 2026-09-02 14:16 UTC · trivy 0.73.0 · vuln DB 2026-09-01.
Wrap
Layers this remote adds. Gate fails on CRITICAL.
none
gate pass
Vendor
In the upstream package. Not patched here.
2 HIGH
Vendor findings 2 · 2 HIGH
| Severity | ID | Package | Installed | Fixed | Title |
|---|---|---|---|---|---|
| HIGH | CVE-2026-73088 | browserslist | 4.28.2 | 4.28.7 | browserslist: Browserslist: Prototype pollution leading to denial of service |
| HIGH | CVE-2026-73089 | browserslist | 4.28.2 | 4.28.7 | browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results |
Previous scans
Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.
| Scanned | Vuln DB | Version | Wrap | Vendor | Report |
|---|---|---|---|---|---|
| 2026-09-02 14:02 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-02 06:51 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-02 04:58 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-02 04:31 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-02 03:57 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-02 03:44 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-02 01:42 UTC | 2026-09-01 | 1.39.1 | none | 2 HIGH | JSON |
| 2026-09-01 07:28 UTC | 2026-09-01 | 1.39.1 | none | none | JSON |
| 2026-09-01 06:51 UTC | 2026-09-01 | 1.39.1 | none | none | JSON |
| 2026-08-31 09:27 UTC | 2026-08-31 | 1.39.1 | none | none | JSON |
| 2026-08-31 07:28 UTC | 2026-08-31 | 1.39.1 | none | none | JSON |
| 2026-08-31 06:50 UTC | 2026-08-31 | 1.39.1 | none | none | JSON |
| 2026-08-30 07:29 UTC | 2026-08-30 | 1.39.1 | none | none | JSON |
| 2026-08-30 06:51 UTC | 2026-08-30 | 1.39.1 | none | none | JSON |