CVE-2026-13601

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.

• CWE-693
• CWE-693

• https://access.redhat.com/security/cve/CVE-2026-13601Vendor Advisory
• https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2494110Issue Tracking, Vendor Advisory
• https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639Patch
• https://gitlab.gnome.org/GNOME/yelp/-/work_items/238Issue Tracking, Mitigation, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-13601Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2494110Issue Tracking, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.jsonVendor Advisory

Published

Jun 29, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• CVE-2026-1359The Genolve – AI image AI video generation plugin for WordPr…8.8
• CVE-2026-13590A security flaw has been discovered in seladb PcapPlusPlus 2…5.6
• CVE-2026-13591A weakness has been identified in DeepMyst Mysti 0.4.0. Affe…5
• CVE-2026-13592A vulnerability was detected in liftoff-sr CIPster up to e8e…7.3
• CVE-2026-13593CSS::Minifier::XS versions before 0.14 for Perl have a memor…6.5
• CVE-2026-13595A flaw was found in the libblkid library of util-linux. Duri…5.3
• CVE-2026-13602We found a chain of combining multiple weaknesses in the pro…7.7
• CVE-2026-13603The payment integration pretix-oppwa provides support for t…9
• CVE-2026-1361ASDA-Soft Stack-based Buffer Overflow Vulnerability9.8
• CVE-2026-1363IAQS and I6 developed by JNC has a Client-Side Enforcement o…9.8
• CVE-2026-1364IAQS and I6 developed by JNC has a Missing Authentication vu…9.8
• CVE-2026-1365Insertion of sensitive information into sent data vulnerabil…6.5