RHSA-2026:57417: Important: yelp security update
Important: yelp security update
Other sources
Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.Security Fix(es): yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/yelpto a version that resolves this vulnerability.Fixed in 3.28.1-2.el7_9 - Upgrade
Upgrade
redhat/yelp-debuginfoto a version that resolves this vulnerability.Fixed in 3.28.1-2.el7_9 - Upgrade
Upgrade
redhat/yelp-develto a version that resolves this vulnerability.Fixed in 3.28.1-2.el7_9 - Upgrade
Upgrade
redhat/yelp-libsto a version that resolves this vulnerability.Fixed in 3.28.1-2.el7_9
Event History
Frequently Asked Questions
Which installed packages are covered by this advisory?
The advisory lists redhat/yelp, redhat/yelp-debuginfo, redhat/yelp-devel, and redhat/yelp-libs.
What conditions are described for exploitation?
The issue involves an overly permissive Content Security Policy in Yelp that allows host file disclosure from Flatpak applications. The provided data does not state any additional attacker prerequisites or configuration requirements.
Does the advisory provide a CVSS score or affected version information?
No. It directs readers to the CVE reference for impact, CVSS score, acknowledgments, and related details, but the provided advisory data does not include a score or version information.