Excessive Content Security Policy Flaw in Yelp's XSL Implementation
CVE-2026-13601
Key Information:
What is CVE-2026-13601?
A significant vulnerability exists in Yelp due to an overly permissive Content Security Policy (CSP) within its yelp-xsl implementation. This flaw allows a malicious Flatpak application to exploit crafted help content via the OpenURI portal. By incorporating an untrusted CSS stylesheet into a structured SVG document, an attacker can bypass Flatpak's sandbox isolation. This may lead to the unauthorized evaluation of local XML inclusions, thereby disclosing sensitive user-readable host files through remote CSS resource requests.
Affected Version(s)
Red Hat Enterprise Linux 8 2:3.28.1-3.el8_10.2
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2:3.28.1-3.el8_4.2
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2:3.28.1-3.el8_4.2
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved