{"id":"CVE-2026-13601","aliases":["ALSA-2026:47177","ALSA-2026:47178","CLSA-2026-1783700414","CLSA-2026-1784539549","DEBIAN-CVE-2026-13601","EUVD-2026-40066","GHSA-f4vh-qr53-q5gv","MGASA-2026-0296","OESA-2026-3053","RHSA-2026:47177","RHSA-2026:47178","RHSA-2026:54539","RHSA-2026:54540","RHSA-2026:54605","RHSA-2026:54624","RHSA-2026:54637","RHSA-2026:54666","RHSA-2026:57417","RLSA-2026:47177","RLSA-2026:47178","SUSE-SU-2026:22625-1","SUSE-SU-2026:3035-1","SUSE-SU-2026:3036-1","SUSE-SU-2026:3037-1","UBUNTU-CVE-2026-13601","USN-8627-1","openSUSE-SU-2026:21295-1"],"status":"published","title":"Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00179,"percentile":0.07588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-06-29T09:20:40Z","modified":"2026-11-04T02:47:33Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"yelp","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"yelp-devel","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"yelp","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"yelp-devel","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"yelp-libs","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"yelp","fixed_in":["2:40.3-2.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"yelp-devel","fixed_in":["2:40.3-2.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"yelp-libs","fixed_in":["2:40.3-2.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"yelp","fixed_in":["2:40.3-2.el9_6.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"yelp-devel","fixed_in":["2:40.3-2.el9_6.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"yelp-libs","fixed_in":["2:40.3-2.el9_6.1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"yelp","fixed_in":["42.2-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"yelp","fixed_in":["42.2-4+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"yelp","fixed_in":["49.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"yelp","fixed_in":["49.0-2.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"yelp","fixed_in":["42.2-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"yelp","fixed_in":["3.36.0-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"yelp","fixed_in":["3.38.3-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"yelp","fixed_in":["42.2-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"yelp","fixed_in":["42.2-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"yelp","fixed_in":["42.3-2.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-devel","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-debuginfo","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-debugsource","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-libs","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-debuginfo","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-debugsource","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-devel","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-libs-debuginfo","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-debuginfo","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-debugsource","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-libs","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-debuginfo","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-debugsource","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-devel","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-libs-debuginfo","fixed_in":["2:40.3-2.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp","fixed_in":["2:40.3-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-debuginfo","fixed_in":["2:40.3-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-debugsource","fixed_in":["2:40.3-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-libs","fixed_in":["2:40.3-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:40.3-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp","fixed_in":["2:40.3-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-debuginfo","fixed_in":["2:40.3-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-debugsource","fixed_in":["2:40.3-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-libs","fixed_in":["2:40.3-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:40.3-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-debuginfo","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-debugsource","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-libs","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-libs-debuginfo","fixed_in":["2:3.28.1-3.el8_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"yelp","fixed_in":["2:3.28.1-2.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"yelp-debuginfo","fixed_in":["2:3.28.1-2.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"yelp-libs","fixed_in":["2:3.28.1-2.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"yelp-devel","fixed_in":["2:3.28.1-2.el7_9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"yelp","fixed_in":["2:3.28.1-3.el8_10.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"yelp","fixed_in":["2:40.3-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"yelp","fixed_in":["42.3-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"yelp","fixed_in":["42.3-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"yelp","fixed_in":["3.20.1-7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"yelp","fixed_in":["3.20.1-7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"yelp","fixed_in":["42.2-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"yelp","fixed_in":["42.2-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"yelp","fixed_in":["42.2-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"yelp","fixed_in":["41.2-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yelp","fixed_in":["3.18.1-1ubuntu4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yelp","fixed_in":["3.26.0-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"yelp","fixed_in":["3.36.2-0ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"yelp","fixed_in":["42.1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"yelp","fixed_in":["42.2-1ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"yelp","fixed_in":["49.0-5ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"yelp","fixed_in":["42.3-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-1+deb12u2"}]}],"versions":["42.2-1","42.2-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-4+deb13u1"}]}],"versions":["42.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49.1-1"}]}],"versions":["42.2-4","42.3-1","42.3-2","42.3-3","49.0-1","49.0-2","49.0-3","49.0-4","49.0-5","49~rc-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49.0-2.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.3-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"yelp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-2.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"yelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-2.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"yelp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-2.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"yelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-2.el7_9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.1-3.el8_10.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:40.3-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.1-7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.1-7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.2-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-1ubuntu4+esm1"}]}],"versions":["3.16.1-1ubuntu1","3.16.1-1ubuntu2","3.18.1-1ubuntu2","3.18.1-1ubuntu3","3.18.1-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-1ubuntu2+esm1"}]}],"versions":["3.26.0-1ubuntu1","3.26.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.2-0ubuntu1.1+esm1"}]}],"versions":["3.34.0-1","3.36.0-1","3.36.2-0ubuntu1","3.36.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.1-1ubuntu0.2"}]}],"versions":["40.stable-1build1","41.1-1","41.2-1","42~beta-2","42.0-1","42.1-1","42.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-1ubuntu0.24.04.2"}]}],"versions":["42.2-1","42.2-1build1","42.2-1build2","42.2-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["42.2-2","42.2-4","42.2-4build1","42.3-1","42.3-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49.0-5ubuntu0.1"}]}],"versions":["42.3-3ubuntu1","49.0-4","49.0-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.1-1ubuntu4+esm1"}]}],"versions":["3.16.1-1ubuntu1","3.16.1-1ubuntu2","3.18.1-1ubuntu2","3.18.1-1ubuntu3","3.18.1-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0-1ubuntu2+esm1"}]}],"versions":["3.26.0-1ubuntu1","3.26.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.2-0ubuntu1.1+esm1"}]}],"versions":["3.34.0-1","3.36.0-1","3.36.2-0ubuntu1","3.36.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.1-1ubuntu0.2"}]}],"versions":["40.stable-1build1","41.1-1","41.2-1","42~beta-2","42.0-1","42.1-1","42.1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2-1ubuntu0.24.04.2"}]}],"versions":["42.2-1","42.2-1build1","42.2-1build2","42.2-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49.0-5ubuntu0.1"}]}],"versions":["42.3-3ubuntu1","49.0-4","49.0-5"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"yelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3-160000.3.1"}]}]}],"products":[{"vendor":"gnome","product":"yelp"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:47177","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47178","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54539","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54540","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54605","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54624","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54637","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54666","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57417","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13601","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report","advisory"]},{"url":"https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/","tags":["Third Party Advisory","article","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494110","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/yelp/-/commit/c8c8244c8a812860782d635890c9b6c43ecc2639","tags":["Patch","fix","article"]},{"url":"https://gitlab.gnome.org/GNOME/yelp/-/work_items/238","tags":["Issue Tracking","Mitigation","Third Party Advisory","web","article","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13601.json","tags":["x_sadp-csaf-vex","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13601","tags":["advisory"]},{"url":"https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp"},{"url":"https://github.com/advisories/GHSA-f4vh-qr53-q5gv"},{"url":"https://bugzilla.redhat.com/2494110","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-47177.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-47178.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783700414.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784539549.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13601.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13601","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0296.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35619","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00230.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3053","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47177.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13601","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47178.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54539.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54540.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54605.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54624.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54637.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54666.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57417.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47177","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47178","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622625-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13601","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263035-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263036-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263037-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-13601","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8627-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-13601","title":"Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T09:20:40.865Z","modified":"2026-11-04T22:04:56.987Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-693","CWE-693"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-40066","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T09:20:40Z","modified":"2026-11-04T22:04:56Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T23:47:18.620008Z"}],"ghsa":[{"id":"GHSA-f4vh-qr53-q5gv","title":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation...","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T12:31:44Z","modified":"2026-08-20T12:31:21Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:10:45.95343Z"}],"nvd":[{"id":"CVE-2026-13601","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T10:16:30.18Z","modified":"2026-11-04T22:17:58.3Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-04T23:43:39.147797Z"}],"osv":[{"id":"CVE-2026-13601","title":"Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T09:20:40.865Z","modified":"2026-11-06T01:04:16.308106572Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"DEBIAN-CVE-2026-13601","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T10:16:30.18Z","modified":"2026-11-05T09:47:38.050405175Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-3053","title":"yelp security update","description":"Yelp is the help viewer in GNOME. It natively views Mallard, DocBook, man, info, and HTML documents. It can locate documents according to the freedesktop.org help system specification.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak\u0026apos;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.(CVE-2026-13601)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:20.255908924Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:47177","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-03T10:17:14Z","modified":"2026-08-21T10:11:55Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47178","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-04T10:25:49Z","modified":"2026-08-21T10:11:55Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:54539","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-14T10:16:50Z","modified":"2026-08-21T10:13:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54540","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-14T10:16:51Z","modified":"2026-08-21T10:13:23Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54605","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-14T10:16:57Z","modified":"2026-08-21T10:13:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54624","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-14T10:16:58Z","modified":"2026-08-21T10:13:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54637","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-14T10:16:59Z","modified":"2026-08-21T10:13:28Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54666","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-14T10:17:06Z","modified":"2026-08-21T10:13:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:57417","title":"Red Hat Security Advisory: yelp security update","status":"published","published":"2026-08-20T10:20:13Z","modified":"2026-08-21T10:13:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:47177","title":"Important: yelp security update","description":"Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.\n\nSecurity Fix(es):\n\n* yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-03T12:01:09.862125Z","modified":"2026-08-03T12:30:05.443717348Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:47178","title":"Important: yelp security update","description":"Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.\n\nSecurity Fix(es):\n\n* yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-03T12:03:50.556944Z","modified":"2026-08-03T12:30:05.31500187Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-13601","description":"A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.","status":"published","published":"2026-06-29T10:16:00Z","modified":"2026-08-17T02:45:04.25894053Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:47177","title":"Important: yelp security update","description":"Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.  \n\nSecurity Fix(es):  \n\n  * yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:02:24.84911365Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:47178","title":"Important: yelp security update","description":"Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.  \n\nSecurity Fix(es):  \n\n  * yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:32:22.612498287Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1783700414","title":"yelp: Fix of CVE-2026-13601","description":"- CVE-2026-13601: fix loading external resources and ghelp:/proc URIs from web pages","status":"published","published":"2026-07-10T16:20:38Z","modified":"2026-10-26T09:30:25.690349451Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784539549","title":"yelp: Fix of CVE-2026-13601","description":"- fix CVE-2026-13601","status":"published","published":"2026-07-20T09:26:11Z","modified":"2026-10-26T09:31:19.107684331Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2026-0296","title":"Updated yelp packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nYelp: yelp-xsl: overly permissive content security policy in yelp allows\nhost file disclosure from flatpak applications. (CVE-2026-13601)\n","status":"published","published":"2026-07-25T18:04:08Z","modified":"2026-07-25T18:15:05.51350491Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21295-1","title":"Security update for yelp","description":"This update for yelp fixes the following issue\n\n- CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications\n  (bsc#1269625).\n","status":"published","published":"2026-07-10T09:30:04Z","modified":"2026-07-13T18:24:58.505210402Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22625-1","title":"Security update for yelp","description":"This update for yelp fixes the following issue\n\n- CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications\n  (bsc#1269625).\n","status":"published","published":"2026-07-10T09:28:14Z","modified":"2026-07-17T18:24:03.696754881Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3035-1","title":"Security update for yelp","description":"This update for yelp fixes the following issue\n\n- CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).\n","status":"published","published":"2026-07-15T11:44:14Z","modified":"2026-07-16T10:00:07.831849957Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3036-1","title":"Security update for yelp","description":"This update for yelp fixes the following issue\n\n- CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).\n","status":"published","published":"2026-07-15T11:44:32Z","modified":"2026-07-16T10:00:07.949561326Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3037-1","title":"Security update for yelp","description":"This update for yelp fixes the following issue\n\n- CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625).\n","status":"published","published":"2026-07-15T11:45:08Z","modified":"2026-07-16T10:00:07.734910326Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8627-1","title":"yelp vulnerability","description":"It was discovered that Yelp incorrectly handled certain crafted help\ndocuments due to an overly permissive Content Security Policy. An\nattacker could trick a user into opening a specially crafted document,\npossibly resulting in the disclosure of sensitive information.","status":"published","published":"2026-08-11T19:27:49Z","modified":"2026-08-17T02:56:54.089658089Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}