Log in Start free

Vulnerability · Published Jun 29, 2026 · Assigned by redhat

CVE-2026-13601Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

High 7.1

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 92.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8yelp2:3.28.1-3.el8_10.2ALSA-2026:47177
AlmaLinux:9yelp2:40.3-3.el9_8.1ALSA-2026:47178
AlmaLinux:8yelp-devel2:3.28.1-3.el8_10.2ALSA-2026:47177
AlmaLinux:9yelp-devel2:40.3-3.el9_8.1ALSA-2026:47178
AlmaLinux:8yelp-libs2:3.28.1-3.el8_10.2ALSA-2026:47177
AlmaLinux:9yelp-libs2:40.3-3.el9_8.1ALSA-2026:47178
Debian:12yelp42.2-1+deb12u2DEBIAN-CVE-2026-13601
Debian:13yelp42.2-4+deb13u1DEBIAN-CVE-2026-13601
Debian:14yelp49.1-1DEBIAN-CVE-2026-13601
Rocky Linux:8yelp2:3.28.1-3.el8_10.2RLSA-2026:47177
Rocky Linux:9yelp2:40.3-3.el9_8.1RLSA-2026:47178
Ubuntu:22.04:LTSyelp42.1-1ubuntu0.2UBUNTU-CVE-2026-13601
Ubuntu:24.04:LTSyelp42.2-1ubuntu0.24.04.2UBUNTU-CVE-2026-13601
Ubuntu:25.10yelpno fix listedUBUNTU-CVE-2026-13601
Ubuntu:26.04:LTSyelp49.0-5ubuntu0.1UBUNTU-CVE-2026-13601

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support see references
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On see references
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service see references
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 6 see references

Weakness: CWE-693 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References