CVE-2026-13601: Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-08-20
Weakness: CWE-693

Description

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Affected products

GNOME Yelp: before 49.1 — fixed in 49.1
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0

How to fix

Upgrade to a fixed version: GNOME Yelp 49.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-13601 or the next vulnerability affects your stack