7.1

CVE-2026-13601: gnome yelp Protection Mechanism Failure

CVSS: 7.1v3.1HighModified
AliasesMGASA-2026-0296SUSE-SU-2026:22625-1SUSE-SU-2026:3035-1
Published 29-06-2026Last modified 20-08-2026
Open JSON

Vulnerability summary

CVE-2026-13601 is a high (CVSS 7.1) Protection Mechanism Failure vulnerability in gnome yelp. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
USN-8627-1

Timeline

  1. 29-06-2026
    PublishedVulnerability first disclosed.
  2. 20-08-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

0.00 pp

From 0.18% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse15 products
  • yelp&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 41.2-150400.3.6.1
  • yelp&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 41.2-150400.3.6.1
  • yelp&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 41.2-150400.3.6.1
  • yelp&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 41.2-150400.3.6.1
  • yelp&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7< 42.2-150600.3.6.1
Redhat7 products
  • enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0
  • yelp< 2:3.28.1-3.el8_10.2 | < 2:40.3-3.el9_8.1 | < 2:40.3-2.el9_6.2 | < 2:40.3-2.el9_4.2 | < 2:3.28.1-3.el8_4.2 | < 2:3.28.1-3.el8_8.2 | < 2:40.3-2.el9_2.2 | < 2:3.28.1-3.el8_6.2 | < 2:3.28.1-2.el7_9
  • yelp-debuginfo< 2:3.28.1-3.el8_10.2 | < 2:40.3-3.el9_8.1 | < 2:40.3-2.el9_6.2 | < 2:40.3-2.el9_4.2 | < 2:3.28.1-3.el8_4.2 | < 2:3.28.1-3.el8_8.2 | < 2:40.3-2.el9_2.2 | < 2:3.28.1-3.el8_6.2 | < 2:3.28.1-2.el7_9
  • yelp-debugsource< 2:3.28.1-3.el8_10.2 | < 2:40.3-3.el9_8.1 | < 2:40.3-2.el9_6.2 | < 2:40.3-2.el9_4.2 | < 2:3.28.1-3.el8_4.2 | < 2:3.28.1-3.el8_8.2 | < 2:40.3-2.el9_2.2 | < 2:3.28.1-3.el8_6.2
  • yelp-devel< 2:3.28.1-3.el8_10.2 | < 2:40.3-3.el9_8.1 | < 2:40.3-2.el9_6.2 | < 2:3.28.1-2.el7_9
Mageia2 products
  • yelp< 49.0-2.1.mga10
  • yelp< 42.2-1.2.mga9
Debian1 product
  • yelp< 42.2-1+deb12u2 | < 42.2-4+deb13u1 | < 49.1-1
Gnome1 product
Opensuse1 product
  • yelp&distro=openSUSE Leap 16.0< 42.3-160000.3.1
Ubuntu1 product
  • yelp< 3.18.1-1ubuntu4+esm1 | < 3.26.0-1ubuntu2+esm1 | < 3.36.2-0ubuntu1.1+esm1 | < 42.1-1ubuntu0.2 | < 42.2-1ubuntu0.24.04.2 | All versions (No fix recorded) | < 49.0-5ubuntu0.1

7 vendors · 28 products

References

39 links
Show all 39 references