7.1
HIGH
CVSS 3.1
CVE-2026-13601
Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications
Overview
Description
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
Details
INFO
Published Date :
June 29, 2026, 10:16 a.m.
Last Modified :
July 15, 2026, 2:18 a.m.
Remotely Exploit :
No
Source :
[email protected]
Impact
Affected Products
The following products are affected by CVE-2026-13601
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 53f830b8-0a3f-465b-8143-3b8a9948e749 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
Address overly permissive CSP by restricting XML parsing and external resource loading.
- Restrict XML parsing to trusted sources.
- Limit external CSS resource loading.
- Review and tighten Content Security Policy.
- Update yelp-xsl to a secure version.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-13601.
| URL | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-13601 | Vendor Advisory |
| https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/ | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2494110 | Issue Tracking Vendor Advisory |
| https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639 | Patch |
| https://gitlab.gnome.org/GNOME/yelp/-/work_items/238 | Issue Tracking Mitigation Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-13601 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2494110 | Issue Tracking Vendor Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-13601 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-13601
weaknesses.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs
CAPEC-17: Using Malicious Files Using Malicious Files
CAPEC-20: Encryption Brute Forcing Encryption Brute Forcing
CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client
CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality
CAPEC-51: Poison Web Service Registry Poison Web Service Registry
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
CAPEC-59: Session Credential Falsification through Prediction Session Credential Falsification through Prediction
CAPEC-65: Sniff Application Code Sniff Application Code
CAPEC-74: Manipulating State Manipulating State
CAPEC-87: Forceful Browsing Forceful Browsing
CAPEC-107: Cross Site Tracing Cross Site Tracing
CAPEC-127: Directory Indexing Directory Indexing
CAPEC-237: Escaping a Sandbox by Calling Code in Another Language Escaping a Sandbox by Calling Code in Another Language
CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content Signature Spoofing by Mixing Signed and Unsigned Content
CAPEC-480: Escaping Virtualization Escaping Virtualization
CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB) Key Negotiation of Bluetooth Attack (KNOB)
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-13601 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-13601 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}] [{'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Added CPE Configuration OR *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Added CPE Configuration OR *cpe:2.3:a:gnome:yelp:*:*:*:*:*:*:*:* versions up to (excluding) 49.1 Added Reference Type Red Hat, Inc.: https://access.redhat.com/security/cve/CVE-2026-13601 Types: Vendor Advisory Added Reference Type Red Hat, Inc.: https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/ Types: Third Party Advisory Added Reference Type Red Hat, Inc.: https://bugzilla.redhat.com/show_bug.cgi?id=2494110 Types: Issue Tracking, Vendor Advisory Added Reference Type Red Hat, Inc.: https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639 Types: Patch Added Reference Type Red Hat, Inc.: https://gitlab.gnome.org/GNOME/yelp/-/work_items/238 Types: Issue Tracking, Mitigation, Third Party Advisory Added Reference Type redhat-SADP: https://access.redhat.com/security/cve/CVE-2026-13601 Types: Vendor Advisory Added Reference Type redhat-SADP: https://bugzilla.redhat.com/show_bug.cgi?id=2494110 Types: Issue Tracking, Vendor Advisory Added Reference Type redhat-SADP: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json Types: Vendor Advisory -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}] Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Added CWE CWE-693 Added Reference https://access.redhat.com/security/cve/CVE-2026-13601 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2494110 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json -
CVE Modified by [email protected]
Jun. 29, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}] [{'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 29, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-13601', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-29T13:26:33.394280Z'} -
New CVE Received by [email protected]
Jun. 29, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'yelp', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'yelp-xsl', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unknown'}] Added Description A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information. Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Added CWE CWE-693 Added Reference https://access.redhat.com/security/cve/CVE-2026-13601 Added Reference https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/ Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2494110 Added Reference https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639 Added Reference https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.