Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-13601— Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GNOME yelp是GNOME基金会开源的一个文档浏览工具。 GNOME yelp存在处理逻辑错误漏洞，该漏洞源于yelp-xsl提供的Content Security Policy实现过于宽松，可能导致恶意Flatpak应用程序通过OpenURI门户打开特制帮助内容，并通过在结构化SVG文档中嵌入不受信任的CSS样式表绕过沙箱隔离，允许Yelp评估本地XML包含并通过远程CSS资源请求泄露任意用户可读的主机文件，导致敏感信息未经授权泄露。以下版本受到影响：Red Hat Enterprise Linu

CVSS 7.1 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 2 AI

T1059.005 · Visual Basic T1403.003
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13601

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Vulnerability Title
GNOME yelp 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GNOME yelp是GNOME基金会开源的一个文档浏览工具。 GNOME yelp存在处理逻辑错误漏洞，该漏洞源于yelp-xsl提供的Content Security Policy实现过于宽松，可能导致恶意Flatpak应用程序通过OpenURI门户打开特制帮助内容，并通过在结构化SVG文档中嵌入不受信任的CSS样式表绕过沙箱隔离，允许Yelp评估本地XML包含并通过远程CSS资源请求泄露任意用户可读的主机文件，导致敏感信息未经授权泄露。以下版本受到影响：Red Hat Enterprise Linu
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 2:3.28.1-2.el7_9 ~ * cpe:/o:redhat:rhel_els:7
Red Hat Red Hat Enterprise Linux 8 2:3.28.1-3.el8_10.2 ~ * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2:3.28.1-3.el8_4.2 ~ * cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2:3.28.1-3.el8_4.2 ~ * cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2:3.28.1-3.el8_6.2 ~ * cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2:3.28.1-3.el8_6.2 ~ * cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2:3.28.1-3.el8_8.2 ~ * cpe:/a:redhat:rhel_e4s:8.8::appstream
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2:3.28.1-3.el8_8.2 ~ * cpe:/a:redhat:rhel_e4s:8.8::appstream
Red Hat Red Hat Enterprise Linux 9 2:40.3-3.el9_8.1 ~ * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2:40.3-2.el9_2.2 ~ * cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2:40.3-2.el9_4.2 ~ * cpe:/a:redhat:rhel_e4s:9.4::appstream
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 2:40.3-2.el9_6.2 ~ * cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:enterprise_linux:6

II. Public POCs for CVE-2026-13601

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13601

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13601 (1)

Vendor Advisories for CVE-2026-13601 (12)

Security Blog Posts for CVE-2026-13601 (1)

Same Patch Batch · Red Hat · 2026-06-29 · 7 CVEs total

CVE-2026-12856 8.8 HIGH Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the
CVE-2026-12912 7.3 HIGH Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
CVE-2026-13595 6.8 MEDIUM Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
CVE-2026-13757 6.2 MEDIUM P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
CVE-2026-57965 5.1 MEDIUM Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow
CVE-2026-57966 4.4 MEDIUM Spice-vdagent: path traversal in file transfer via unsanitized filename

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 7 Extended Lifecycle Support
Same vendor: Red Hat
Same weakness: CWE-693

V. Comments for CVE-2026-13601

No comments yet

Leave a comment