CVE-2026-13601 Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications

High 7.1 Published 29 Jun 2026 Updated 20 Aug 2026

A malicious Flatpak app can bypass sandbox isolation via crafted SVG/CSS in Yelp, disclosing arbitrary host files to the attacker.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-13601?

CVE-2026-13601 is a high-severity vulnerability in Redhat Enterprise Linux, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

Weakness: CWE-693

Which versions are affected by CVE-2026-13601?

It affects 2 products.

Linux distribution packages (40)

`yelp` AlmaLinux:8	All versions	`2:3.28.1-3.el8_10.2`
`yelp-devel` AlmaLinux:8	All versions	`2:3.28.1-3.el8_10.2`
`yelp-libs` AlmaLinux:8	All versions	`2:3.28.1-3.el8_10.2`
`yelp` AlmaLinux:9	All versions	`2:40.3-3.el9_8.1`
`yelp-devel` AlmaLinux:9	All versions	`2:40.3-3.el9_8.1`
`yelp-libs` AlmaLinux:9	All versions	`2:40.3-3.el9_8.1`
`yelp` Red Hat:enterprise_linux:8::appstream	All versions	`2:3.28.1-3.el8_10.2`
`yelp-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`2:3.28.1-3.el8_10.2`
`yelp-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`2:3.28.1-3.el8_10.2`
`yelp-libs` Red Hat:enterprise_linux:8::appstream	All versions	`2:3.28.1-3.el8_10.2`
`yelp-libs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`2:3.28.1-3.el8_10.2`
`yelp-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`2:3.28.1-3.el8_10.2`
`yelp-debugsource` Red Hat:enterprise_linux:8::crb	All versions	`2:3.28.1-3.el8_10.2`
`yelp-devel` Red Hat:enterprise_linux:8::crb	All versions	`2:3.28.1-3.el8_10.2`
`yelp-libs-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`2:3.28.1-3.el8_10.2`
`yelp` Red Hat:enterprise_linux:9::appstream	All versions	`2:40.3-3.el9_8.1`
`yelp-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`2:40.3-3.el9_8.1`
`yelp-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`2:40.3-3.el9_8.1`
`yelp-libs` Red Hat:enterprise_linux:9::appstream	All versions	`2:40.3-3.el9_8.1`
`yelp-libs-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`2:40.3-3.el9_8.1`
`yelp-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`2:40.3-3.el9_8.1`
`yelp-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`2:40.3-3.el9_8.1`
`yelp-devel` Red Hat:enterprise_linux:9::crb	All versions	`2:40.3-3.el9_8.1`
`yelp-libs-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`2:40.3-3.el9_8.1`
`yelp` Red Hat:rhel_aus:8.4::appstream	All versions	`2:3.28.1-3.el8_4.2`
`yelp-debuginfo` Red Hat:rhel_aus:8.4::appstream	All versions	`2:3.28.1-3.el8_4.2`
`yelp-debugsource` Red Hat:rhel_aus:8.4::appstream	All versions	`2:3.28.1-3.el8_4.2`
`yelp-libs` Red Hat:rhel_aus:8.4::appstream	All versions	`2:3.28.1-3.el8_4.2`
`yelp-libs-debuginfo` Red Hat:rhel_aus:8.4::appstream	All versions	`2:3.28.1-3.el8_4.2`
`yelp` Red Hat:rhel_aus:8.6::appstream	All versions	`2:3.28.1-3.el8_6.2`
`yelp-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`2:3.28.1-3.el8_6.2`
`yelp-debugsource` Red Hat:rhel_aus:8.6::appstream	All versions	`2:3.28.1-3.el8_6.2`
`yelp-libs` Red Hat:rhel_aus:8.6::appstream	All versions	`2:3.28.1-3.el8_6.2`
`yelp-libs-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`2:3.28.1-3.el8_6.2`
`yelp` Red Hat:rhel_e4s:8.8::appstream	All versions	`2:3.28.1-3.el8_8.2`
`yelp-debuginfo` Red Hat:rhel_e4s:8.8::appstream	All versions	`2:3.28.1-3.el8_8.2`
`yelp-debugsource` Red Hat:rhel_e4s:8.8::appstream	All versions	`2:3.28.1-3.el8_8.2`
`yelp-libs` Red Hat:rhel_e4s:8.8::appstream	All versions	`2:3.28.1-3.el8_8.2`
`yelp-libs-debuginfo` Red Hat:rhel_e4s:8.8::appstream	All versions	`2:3.28.1-3.el8_8.2`
`yelp` Red Hat:rhel_e4s:9.2::appstream	All versions	`2:40.3-2.el9_2.2`

Products include Gnome Yelp, Redhat Enterprise Linux.

How do I fix CVE-2026-13601?

Apply the vendor's patch.

Is CVE-2026-13601 being exploited?

There is no known exploitation of CVE-2026-13601 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:47177, ALSA-2026:47178, CLSA-2026-1783700414, CLSA-2026-1784539549, DEBIAN-CVE-2026-13601, GHSA-f4vh-qr53-q5gv and 20 more.