CVE-2026-13601
Description
A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.
How to fix
- gnome yelp49.1 or later
- access.redhat.com/security/cve/CVE-2026-13601
- bugzilla.redhat.com/show_bug.cgi?id=2494110
- gitlab.gnome.org/GNOME/yelp/-/work_items/238
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json
- access.redhat.com/errata/RHSA-2026:47177
- access.redhat.com/errata/RHSA-2026:47178
- access.redhat.com/errata/RHSA-2026:54539
- access.redhat.com/errata/RHSA-2026:54540
- access.redhat.com/errata/RHSA-2026:54605
- access.redhat.com/errata/RHSA-2026:54624
- access.redhat.com/errata/RHSA-2026:54637
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnome yelp | v < 49.1 | 49.1 |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.