CVE-2026-13601
published 2026-06-29CVE-2026-13601: A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can…
PriorityP434medium6.5CVSS 3.1
AVLACLPRLUINSCCHINAN
EPSS
0.18%
7.4th percentile
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | yelp | < 49.1 | 49.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | yelp | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl.
ghsa_unreviewed·2026-06-29
CVE-2026-13601 [HIGH] CWE-693 A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl.
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
Ubuntu
Yelp vulnerability
vendor_ubuntu·2026-08-11
CVE-2026-13601 Yelp vulnerability
Title: Yelp vulnerability
Summary: Yelp could be made to expose sensitive information.
It was discovered that Yelp incorrectly handled certain crafted help
documents due to an overly permissive Content Security Policy. An
attacker could trick a user into opening a specially crafted document,
possibly resulting in the disclosure of sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
vendor_redhat·2026-05-07·CVSS 7.1
CVE-2026-13601 [HIGH] CWE-693 yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
Statement: This vulnerability affects the Content Security Policy (CSP) implementation handling help documents
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-13601 yelp: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [fedora-all]
bugzilla·2026-06-29·CVSS 7.1
CVE-2026-13601 [HIGH] CVE-2026-13601 yelp: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [fedora-all]
CVE-2026-13601 yelp: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local sandbox escape and host information disclosure flaw was found in Yelp. A regression introduced in the companion yelp-xsl stylesheet component targets the gnome-42 and master development branches, leaving the application's Content Security Policy (CSP) style handling directives overly permissive.
A malicious or compromised sandboxed Flatpak application can programmatically abuse the standard host org.freedesktop.portal.OpenU
Bugzilla
CVE-2026-13601 yelp: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [epel-all]
bugzilla·2026-06-29·CVSS 7.1
CVE-2026-13601 [HIGH] CVE-2026-13601 yelp: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [epel-all]
CVE-2026-13601 yelp: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local sandbox escape and host information disclosure flaw was found in Yelp. A regression introduced in the companion yelp-xsl stylesheet component targets the gnome-42 and master development branches, leaving the application's Content Security Policy (CSP) style handling directives overly permissive.
A malicious or compromised sandboxed Flatpak application can programmatically abuse the standard host org.freedesktop.portal.OpenURI
Bugzilla
CVE-2026-13601 yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [fedora-all]
bugzilla·2026-06-29·CVSS 7.1
CVE-2026-13601 [HIGH] CVE-2026-13601 yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [fedora-all]
CVE-2026-13601 yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local sandbox escape and host information disclosure flaw was found in Yelp. A regression introduced in the companion yelp-xsl stylesheet component targets the gnome-42 and master development branches, leaving the application's Content Security Policy (CSP) style handling directives overly permissive.
A malicious or compromised sandboxed Flatpak application can programmatically abuse the standard host org.freedesktop.portal.O
Bugzilla
CVE-2026-13601 yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
bugzilla·2026-06-29·CVSS 7.1
CVE-2026-13601 [HIGH] CVE-2026-13601 yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
CVE-2026-13601 yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
A local sandbox escape and host information disclosure flaw was found in Yelp. A regression introduced in the companion yelp-xsl stylesheet component targets the gnome-42 and master development branches, leaving the application's Content Security Policy (CSP) style handling directives overly permissive.
A malicious or compromised sandboxed Flatpak application can programmatically abuse the standard host org.freedesktop.portal.OpenURI portal interface to pass crafted help layout files (ghelp:// or mallard extensions). Because the system portal processes this request silently without requiring user interaction, host-level Yelp is automatically invoked to pa
Bugzilla
CVE-2025-13601 glib: Integer overflow in in g_escape_uri_string()
bugzilla·2025-11-24·CVSS 7.7
CVE-2025-13601 [HIGH] CVE-2025-13601 glib: Integer overflow in in g_escape_uri_string()
CVE-2025-13601 glib: Integer overflow in in g_escape_uri_string()
An overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2026:0936 https://access.redhat.com/errata/RHSA-2026:0936
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:0975 https://access.redhat.com/errata/RHSA-2026:0975
---
This issue has been addres
https://access.redhat.com/errata/RHSA-2026:47177https://access.redhat.com/errata/RHSA-2026:47178https://access.redhat.com/errata/RHSA-2026:54539https://access.redhat.com/errata/RHSA-2026:54540https://access.redhat.com/errata/RHSA-2026:54605https://access.redhat.com/errata/RHSA-2026:54624https://access.redhat.com/errata/RHSA-2026:54637https://access.redhat.com/errata/RHSA-2026:54666https://access.redhat.com/errata/RHSA-2026:57417https://access.redhat.com/security/cve/CVE-2026-13601https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/https://bugzilla.redhat.com/show_bug.cgi?id=2494110https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639https://gitlab.gnome.org/GNOME/yelp/-/work_items/238https://access.redhat.com/errata/RHSA-2026:47177https://access.redhat.com/errata/RHSA-2026:47178https://access.redhat.com/errata/RHSA-2026:54539https://access.redhat.com/errata/RHSA-2026:54540https://access.redhat.com/errata/RHSA-2026:54605https://access.redhat.com/errata/RHSA-2026:54624https://access.redhat.com/errata/RHSA-2026:54637https://access.redhat.com/errata/RHSA-2026:54666https://access.redhat.com/errata/RHSA-2026:57417https://access.redhat.com/security/cve/CVE-2026-13601https://bugzilla.redhat.com/show_bug.cgi?id=2494110https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json
2026-06-29
Published