CVE-2026-13601: Gnome Yelp

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Affected products

• Gnome Yelp: before 49.1 (fixed in 49.1)
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only; version 9.0 only

Published 2026-06-29. Last modified 2026-08-20.