CVE-2026-13601 — HIGH (7.1)

Q: How severe is CVE-2026-13601?

CVE-2026-13601 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-13601?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux, Gnome Yelp.

Vulnerability Description

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

CVSS Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Enterprise Linux	6.0
Gnome	Yelp	< 49.1

Related Weaknesses (CWE)

CWE-693

References

FAQ

What is CVE-2026-13601?

CVE-2026-13601 is a vulnerability with a CVSS score of 7.1 (HIGH). A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenUR...

How severe is CVE-2026-13601?

CVE-2026-13601 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-13601?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux, Gnome Yelp.