Proton Pass
Encrypted password manager
![]()
Proton Pass desktop is the official Linux application for the Proton Pass password manager. This Flatpak wraps the official Linux RPM with zypak. It is not a vendor-official Flatpak and not the community Flathub wrapper.
Proton Pass is proprietary freeware; this Flatpak is a redistribution of the official RPM, not vendor official.


Install
flatpak --user remote-add --if-not-exists thepeoples \
https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.ProtonPass
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.42.0Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.
Previous versions
The remote keeps the current tree plus the last two vendor versions as extra ostree branches for rollback. Objects stay on the remote after a branch is dropped (publish does not delete).
- Version
1.39.1(ostree7a81ead4e548dd69b1157f993ef2ba8f63e5a7343504e10f0e62a75ffb5c5120)
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.39.1- Version
1.40.0(ostree6fd8a3293ddf2ab3fa6bb709889a1fb2a0eac30bca89bd1e6979283d9fbcf2ee)
flatpak --user install -y thepeoples io.thepeoples.ProtonPass//1.40.0Verify
- App id
io.thepeoples.ProtonPass, vendor Proton AG, version1.42.0, license proprietary - Download 151.9 MB · installed 393.6 MB
- sha256
aa888e2d6e1e63cf13b9ab777e20302647ea38e19fa9a55a7dafb7f91ce25ae1 - sha512
8b5523a6da4d29eb75c8d271911fac37e0b9e4acc1b8eacbd5c2a2797b99f5c2927bd0444f55f45359fe9feee2778639201dd2bd548876b7383775ac1f1a7582(official source, checked after download fromhttps://proton.me/download/pass/linux/version.json) - Ostree key fingerprint
98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841 - Homepage https://proton.me/pass
Input scan
Pinned rpm proton-pass-1.42.0-1.x86_64.rpm, extracted without install scripts, scanned before wrap. 2026-10-14 19:38 UTC · trivy 0.73.0 · vuln DB 2026-10-14.
Wrap
Layers this remote adds. Gate fails on CRITICAL.
none
gate pass
Vendor
In the upstream package. Not patched here.
4 HIGH
Vendor findings 4 · 4 HIGH
| Severity | ID | Package | Installed | Fixed | Title |
|---|---|---|---|---|---|
| HIGH | CVE-2026-102673 | electron | 39.8.10 | 41.10.4, 42.5.2, 43.0.0 | electron: Electron: Sandbox bypass via popups opened from sandboxed iframes |
| HIGH | CVE-2026-102674 | electron | 39.8.10 | 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5 | electron: Electron: Sandbox bypass via popup window creation |
| HIGH | CVE-2026-102675 | electron | 39.8.10 | 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5 | electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers |
| HIGH | CVE-2026-102676 | electron | 39.8.10 | 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5 | electron: electron: Privilege escalation via unauthorized Node.js integration in web workers |
Previous scans
Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.
| Scanned | Vuln DB | Version | Wrap | Vendor | Report |
|---|---|---|---|---|---|
| 2026-10-14 06:51 UTC | 2026-10-14 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-13 06:57 UTC | 2026-10-13 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-12 09:28 UTC | 2026-10-12 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-12 06:51 UTC | 2026-10-12 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-11 06:52 UTC | 2026-10-11 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-10 06:51 UTC | 2026-10-10 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-09 06:51 UTC | 2026-10-08 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-08 19:31 UTC | 2026-10-08 | 1.42.0 | none | 4 HIGH | JSON |
| 2026-10-08 06:51 UTC | 2026-10-07 | 1.41.1 | none | 4 HIGH | JSON |
| 2026-10-07 06:51 UTC | 2026-10-07 | 1.41.1 | none | 4 HIGH | JSON |
| 2026-10-06 06:51 UTC | 2026-10-06 | 1.41.1 | none | 4 HIGH | JSON |
| 2026-09-27 07:34 UTC | 2026-09-27 | 1.41.1 | none | none | JSON |
| 2026-09-27 06:52 UTC | 2026-09-27 | 1.41.1 | none | none | JSON |
| 2026-09-26 07:08 UTC | 2026-09-26 | 1.41.1 | none | none | JSON |