CVE-2026-13601A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl.
Updated under an hour ago ()
Does this affect you?
It affects redhat enterprise_linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
- CVSS
- 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- CWE-693
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Modified
- Record last updated
- Aug 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
redhat enterprise_linux redhat:enterprise_linux | 6.0; 7.0; 8.0; 9.0 | NVD |
gnome yelp gnome:yelp | before 49.1 | NVD |
References
- https://access.redhat.com/errata/RHSA-2026:47177
- https://access.redhat.com/errata/RHSA-2026:47178
- https://access.redhat.com/errata/RHSA-2026:54539
- https://access.redhat.com/errata/RHSA-2026:54540
- https://access.redhat.com/errata/RHSA-2026:54605
- https://access.redhat.com/errata/RHSA-2026:54624
- https://access.redhat.com/errata/RHSA-2026:54637
- https://access.redhat.com/errata/RHSA-2026:54666
- https://access.redhat.com/errata/RHSA-2026:57417
- https://access.redhat.com/security/cve/CVE-2026-13601vendor-advisory
- https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2494110issue-tracking, vendor-advisory
- https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639patch
- https://gitlab.gnome.org/GNOME/yelp/-/work_items/238issue-tracking, mitigation, third-party-advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.jsonvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.