Bug 2494110 (CVE-2026-13601) - CVE-2026-13601 yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications
Summary: CVE-2026-13601 yelp: yelp-xsl: Overly Permissive Content Security Policy in Y...
Keywords:
Status: NEW
Alias: CVE-2026-13601
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2494116 2494117 2494118
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-29 08:53 UTC by OSIDB Bzimport
Modified: 2026-08-13 18:12 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:47177 0 None None None 2026-07-29 01:05:18 UTC
Red Hat Product Errata RHSA-2026:47178 0 None None None 2026-07-29 01:43:58 UTC
Red Hat Product Errata RHSA-2026:54539 0 None None None 2026-08-13 12:58:05 UTC
Red Hat Product Errata RHSA-2026:54540 0 None None None 2026-08-13 12:47:16 UTC
Red Hat Product Errata RHSA-2026:54605 0 None None None 2026-08-13 15:30:00 UTC
Red Hat Product Errata RHSA-2026:54624 0 None None None 2026-08-13 16:05:19 UTC
Red Hat Product Errata RHSA-2026:54637 0 None None None 2026-08-13 16:40:58 UTC
Red Hat Product Errata RHSA-2026:54666 0 None None None 2026-08-13 18:12:03 UTC

Description OSIDB Bzimport 2026-06-29 08:53:59 UTC 
A local sandbox escape and host information disclosure flaw was found in Yelp. A regression introduced in the companion yelp-xsl stylesheet component targets the gnome-42 and master development branches, leaving the application's Content Security Policy (CSP) style handling directives overly permissive.

A malicious or compromised sandboxed Flatpak application can programmatically abuse the standard host org.freedesktop.portal.OpenURI portal interface to pass crafted help layout files (ghelp:// or mallard extensions). Because the system portal processes this request silently without requiring user interaction, host-level Yelp is automatically invoked to parse the file outside the application container. The attacker-controlled layout leverages local XML inclusions to load arbitrary host-level files into memory, which are subsequently exfiltrated out-of-band to a remote server using a background CSS url() query embedded inside a structured SVG document.
Comment 4 errata-xmlrpc 2026-07-29 01:05:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:47177 https://access.redhat.com/errata/RHSA-2026:47177
Comment 5 errata-xmlrpc 2026-07-29 01:43:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:47178 https://access.redhat.com/errata/RHSA-2026:47178
Comment 6 errata-xmlrpc 2026-08-13 12:47:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:54540 https://access.redhat.com/errata/RHSA-2026:54540
Comment 7 errata-xmlrpc 2026-08-13 12:58:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:54539 https://access.redhat.com/errata/RHSA-2026:54539
Comment 8 errata-xmlrpc 2026-08-13 15:29:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:54605 https://access.redhat.com/errata/RHSA-2026:54605
Comment 9 errata-xmlrpc 2026-08-13 16:05:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:54624 https://access.redhat.com/errata/RHSA-2026:54624
Comment 10 errata-xmlrpc 2026-08-13 16:40:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:54637 https://access.redhat.com/errata/RHSA-2026:54637
Comment 11 errata-xmlrpc 2026-08-13 18:12:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:54666 https://access.redhat.com/errata/RHSA-2026:54666
Note You need to log in before you can comment on or make changes to this bug.