CVE-2025-3155: Yelp: arbitrary file read
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Other sources
Yelp, the GNOME user help application, allows help documents to execute arbitrary JavaScript. A malicious help document may exfiltrate user files to a remote server.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/yelpto a version that resolves this vulnerability.Fixed in 42.2-3Fixed in 42.2-4 - Upgrade
Upgrade
debian/yelp-xslto a version that resolves this vulnerability.Fixed in 42.1-4 - Compensating control
Prevent untrusted users from providing or opening Yelp/GNOME help documents (since Yelp help documents can execute arbitrary JavaScript and may exfiltrate user files via the ghelp scheme).
- Compensating control
Do not open/consume Yelp help documents from untrusted sources, as malicious help documents may execute arbitrary scripts and exfiltrate user files to an external environment.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3155?
CVE-2025-3155 is classified as a high-severity vulnerability due to the potential for arbitrary script execution.
How do I fix CVE-2025-3155?
To fix CVE-2025-3155, update the Yelp application to the latest version that addresses this vulnerability.
What type of vulnerabilities are associated with CVE-2025-3155?
CVE-2025-3155 is associated with code injection and arbitrary file access vulnerabilities.
Who is affected by CVE-2025-3155?
Users of the GNOME Yelp application are affected by CVE-2025-3155.
What can attackers achieve with CVE-2025-3155?
Attackers can execute arbitrary scripts, potentially exfiltrating user files to an external environment.