CVE-2026-13601

EUVD-2026-40066
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.73%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
gnomeyelp
𝑥
< 49.1
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 8
2:3.28.1-3.el8_10.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
2:3.28.1-3.el8_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
2:3.28.1-3.el8_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
2:3.28.1-3.el8_6.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
2:3.28.1-3.el8_6.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service
2:3.28.1-3.el8_8.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions
2:3.28.1-3.el8_8.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9
2:40.3-3.el9_8.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions
2:40.3-2.el9_2.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions
2:40.3-2.el9_4.2 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support
2:40.3-2.el9_6.2 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
yelp
bookworm
42.2-1+deb12u2
fixed
bookworm (security)
42.2-1+deb12u2
fixed
forky
49.1-3
fixed
sid
49.2-1
fixed
trixie
42.2-4+deb13u1
fixed
trixie (security)
42.2-4+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
yelp
bionic
Fixed 3.26.0-1ubuntu2+esm1
released
focal
Fixed 3.36.2-0ubuntu1.1+esm1
released
jammy
Fixed 42.1-1ubuntu0.2
released
noble
Fixed 42.2-1ubuntu0.24.04.2
released
questing
ignored
resolute
Fixed 49.0-5ubuntu0.1
released
xenial
Fixed 3.18.1-1ubuntu4+esm1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libyelp0
suse enterprise desktop 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise sap 12 SP5
3.20.1-7.6.1
fixed
suse enterprise sap 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise sap 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise server 12 SP3
3.20.1-7.6.1
fixed
suse enterprise server 12 SP5
3.20.1-7.6.1
fixed
suse enterprise server 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise server 15 SP7
42.2-150600.3.6.1
fixed
yelp
suse enterprise desktop 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise sap 12 SP5
3.20.1-7.6.1
fixed
suse enterprise sap 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise sap 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise server 12 SP3
3.20.1-7.6.1
fixed
suse enterprise server 12 SP5
3.20.1-7.6.1
fixed
suse enterprise server 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise server 15 SP7
42.2-150600.3.6.1
fixed
yelp-devel
suse enterprise desktop 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise sap 12 SP5
3.20.1-7.6.1
fixed
suse enterprise sap 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise sap 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise server 12 SP5
3.20.1-7.6.1
fixed
suse enterprise server 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise server 15 SP7
42.2-150600.3.6.1
fixed
yelp-lang
suse enterprise desktop 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise sap 12 SP5
3.20.1-7.6.1
fixed
suse enterprise sap 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise sap 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise sap 15 SP7
42.2-150600.3.6.1
fixed
suse enterprise server 12 SP3
3.20.1-7.6.1
fixed
suse enterprise server 12 SP5
3.20.1-7.6.1
fixed
suse enterprise server 15 SP4
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP5
41.2-150400.3.6.1
fixed
suse enterprise server 15 SP6
42.2-150600.3.6.1
fixed
suse enterprise server 15 SP7
42.2-150600.3.6.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
yelp
RHEL 8
2:3.28.1-3.el8_10.2
fixed
RHEL 8.4 AUS
2:3.28.1-3.el8_4.2
fixed
RHEL 8.6 AUS
2:3.28.1-3.el8_6.2
fixed
RHEL 8.8 E4S
2:3.28.1-3.el8_8.2
fixed
RHEL 8.8 TUS
2:3.28.1-3.el8_8.2
fixed
RHEL 9
2:40.3-3.el9_8.1
fixed
yelp-devel
RHEL 8
2:3.28.1-3.el8_10.2
fixed
RHEL 9
2:40.3-3.el9_8.1
fixed
yelp-libs
RHEL 8
2:3.28.1-3.el8_10.2
fixed
RHEL 8.4 AUS
2:3.28.1-3.el8_4.2
fixed
RHEL 8.6 AUS
2:3.28.1-3.el8_6.2
fixed
RHEL 8.8 E4S
2:3.28.1-3.el8_8.2
fixed
RHEL 8.8 TUS
2:3.28.1-3.el8_8.2
fixed
RHEL 9
2:40.3-3.el9_8.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
yelp
Amazon Linux 2
2:3.28.1-1.amzn2.0.2
fixed
yelp-debuginfo
Amazon Linux 2
2:3.28.1-1.amzn2.0.2
fixed
yelp-devel
Amazon Linux 2
2:3.28.1-1.amzn2.0.2
fixed
yelp-libs
Amazon Linux 2
2:3.28.1-1.amzn2.0.2
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:47177
https://access.redhat.com/errata/RHSA-2026:47178
https://access.redhat.com/errata/RHSA-2026:54539
https://access.redhat.com/errata/RHSA-2026:54540
https://access.redhat.com/errata/RHSA-2026:54605
https://access.redhat.com/errata/RHSA-2026:54624
https://access.redhat.com/errata/RHSA-2026:54637
https://access.redhat.com/errata/RHSA-2026:54666
https://access.redhat.com/errata/RHSA-2026:57417
https://access.redhat.com/security/cve/CVE-2026-13601
https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/
https://bugzilla.redhat.com/show_bug.cgi?id=2494110
https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639
https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
https://access.redhat.com/errata/RHSA-2026:47177
https://access.redhat.com/errata/RHSA-2026:47178
https://access.redhat.com/errata/RHSA-2026:54539
https://access.redhat.com/errata/RHSA-2026:54540
https://access.redhat.com/errata/RHSA-2026:54605
https://access.redhat.com/errata/RHSA-2026:54624
https://access.redhat.com/errata/RHSA-2026:54637
https://access.redhat.com/errata/RHSA-2026:54666
https://access.redhat.com/errata/RHSA-2026:57417
https://access.redhat.com/security/cve/CVE-2026-13601
https://bugzilla.redhat.com/show_bug.cgi?id=2494110
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json