CVE-2026-13601: GNOME Yelp CSP Bypass & Sandbox Escape – File Disclosure Risk

Technical summary

CVE-2026-13601 exploits an overly permissive Content Security Policy (CSP) implementation in yelp-xsl, a component of GNOME Yelp. The vulnerability stems from improper handling of untrusted CSS stylesheets within SVG documents. When a malicious Flatpak application opens crafted help content through the OpenURI portal, Yelp fails to properly isolate the content. This allows attackers to leverage CSS resource requests to trigger local XML inclusion evaluation, enabling arbitrary file disclosure from the host system. The attack chain relies on the combination of permissive CSP rules and inadequate validation of external resource references within structured documents. The CVSS 3.1 score of 7.1 (HIGH) reflects the local attack vector, no privilege requirement, high confidentiality impact, and the sandbox escape implications (scope change).

Business impact

This vulnerability creates a sandbox escape risk for any desktop environment using GNOME Yelp with Flatpak containment. Organizations relying on Flatpak to isolate third-party or untrusted applications face potential data leakage. A compromised or malicious Flatpak application can now read user configuration files, SSH keys, browser credentials, or other sensitive host files, fundamentally undermining the security model of containerized desktop applications. The exposure is compounded because the exfiltration mechanism (CSS resource requests) may evade simple network monitoring.

Affected systems

GNOME Yelp is affected across multiple Red Hat Enterprise Linux versions. The vulnerability impacts any system running vulnerable Yelp versions where Flatpak is used for application isolation. Users of GNOME desktop environments who rely on Yelp for help documentation—particularly in enterprise or security-conscious environments—are at risk. The flaw affects the help system directly, so the attack surface includes any mechanism that causes Yelp to render help content, including help invocations from other applications.

Exploitability

Exploitability is straightforward given the low attack complexity and no privilege requirement. An attacker needs to either control or compromise a Flatpak application on the target system, then trigger help content rendering through OpenURI. The attack does not require user interaction beyond normal help system usage (covered by the CVSS 'UI:N' setting). Because Flatpak is designed to isolate untrusted applications, the scenario where a malicious Flatpak app is already installed is realistic. However, this is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting in-the-wild exploitation has not been widely reported as of the modification date.

Remediation

Apply security updates provided by Red Hat and GNOME for both the yelp package and yelp-xsl component. Patch versions should be obtained from official Red Hat security advisories and GNOME release notes; verify against vendor documentation for your specific Enterprise Linux version. In addition to patching, organizations should review Flatpak security policies to ensure applications receive minimal necessary permissions and consider disabling help portal access for untrusted applications if operational constraints permit.

Patch guidance

Monitor Red Hat Security Advisories (RHSA) for Yelp and yelp-xsl updates applicable to your Enterprise Linux version. GNOME upstream may release fixes independently; check GNOME's official release notes and security notices. Apply patches to both yelp and yelp-xsl during your standard maintenance windows. For Flatpak-based deployments, verify that updated Yelp packages are included in your Flatpak runtime or application bundles and rebuild/republish as needed. Test help system functionality after patching to ensure no regression.

Detection guidance

Monitor for unusual file access patterns from Yelp processes, particularly reads of sensitive files (SSH keys, configuration directories, credential stores). Watch for unexpected outbound connections initiated by Yelp or processes running within a Flatpak environment. Log analysis of CSS resource requests originating from help system rendering may reveal attack attempts. Consider blocking or restricting CSS resource loading from help content in network policies if feasible. Intrusion detection systems should flag Flatpak processes attempting to read files outside their intended scope.

Why prioritize this

Despite a CVSS score of 7.1 (HIGH), this vulnerability merits immediate attention because it represents a sandbox escape—a critical failure of containerization security. Any organization using Flatpak for application isolation should treat this as high-priority. The local attack vector and ease of exploitation (no privilege, low complexity) mean that once a malicious or compromised Flatpak app is present, the vulnerability is trivial to exploit. However, the absence of KEV listing suggests limited real-world exploitation so far, allowing for a measured but urgent patching timeline rather than emergency response.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: (1) Local Attack Vector (AV:L)—the attacker must operate from the local system; (2) Low Attack Complexity (AC:L)—no special conditions are needed; (3) No Privileges Required (PR:N)—any local user can run a Flatpak; (4) No User Interaction (UI:N)—help system invocation is automatic; (5) Scope Change (S:C)—the vulnerability impacts beyond the vulnerable component, affecting host system confidentiality; (6) High Confidentiality Impact (C:H)—arbitrary files can be read; (7) No Integrity or Availability Impact (I:N, A:N). The scope change elevates severity from a component-level issue to a system-level escape.

Frequently asked questions