Red Hat Security Advisory: yelp security update
A security vulnerability (CVE-2026-13601) was identified in Yelp, the GNOME desktop help browser, due to an overly permissive Content Security Policy. This flaw allows Flatpak applications to disclose host files. Red Hat has issued an important security update for Yelp in Red Hat Enterprise Linux 9 to address this issue.
AI Analysis
Technical Summary
CVE-2026-13601 is a vulnerability in Yelp's yelp-xsl component where an overly permissive Content Security Policy enables Flatpak applications to disclose host files. Yelp is a help browser for GNOME that aggregates system documentation. The vulnerability was identified and fixed by Red Hat in an advisory (RHSA-2026:47178) targeting Red Hat Enterprise Linux 9 and its variants. The fix addresses the CSP misconfiguration to prevent unauthorized file disclosure from Flatpak sandboxed applications.
Potential Impact
The vulnerability allows Flatpak applications running on affected systems to bypass intended content security restrictions, potentially leading to disclosure of host system files. This could expose sensitive information to untrusted applications within the Flatpak sandbox environment. The issue is rated as high severity by Red Hat Product Security, indicating a significant risk if exploited.
Mitigation Recommendations
Red Hat has released an official security update for Yelp in Red Hat Enterprise Linux 9 and related variants to fix this vulnerability. Users should apply the update as described in Red Hat advisory RHSA-2026:47178 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patch. Patch status is confirmed as available.
Red Hat Security Advisory: yelp security update
Description
A security vulnerability (CVE-2026-13601) was identified in Yelp, the GNOME desktop help browser, due to an overly permissive Content Security Policy. This flaw allows Flatpak applications to disclose host files. Red Hat has issued an important security update for Yelp in Red Hat Enterprise Linux 9 to address this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13601 is a vulnerability in Yelp's yelp-xsl component where an overly permissive Content Security Policy enables Flatpak applications to disclose host files. Yelp is a help browser for GNOME that aggregates system documentation. The vulnerability was identified and fixed by Red Hat in an advisory (RHSA-2026:47178) targeting Red Hat Enterprise Linux 9 and its variants. The fix addresses the CSP misconfiguration to prevent unauthorized file disclosure from Flatpak sandboxed applications.
Potential Impact
The vulnerability allows Flatpak applications running on affected systems to bypass intended content security restrictions, potentially leading to disclosure of host system files. This could expose sensitive information to untrusted applications within the Flatpak sandbox environment. The issue is rated as high severity by Red Hat Product Security, indicating a significant risk if exploited.
Mitigation Recommendations
Red Hat has released an official security update for Yelp in Red Hat Enterprise Linux 9 and related variants to fix this vulnerability. Users should apply the update as described in Red Hat advisory RHSA-2026:47178 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patch. Patch status is confirmed as available.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:47178
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a710678bf32cb7a34396734
Added to database: 08/03/2026, 21:22:00 UTC
Last enriched: 08/03/2026, 21:37:53 UTC
Last updated: 08/04/2026, 03:17:46 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.