Critical Security Flaw in Yelp Package: Host File Disclosure Vulnerability
Summary
ALSA-2026:47177: Important: yelp security update. Affects yelp versions < 2:3.28.1-3.el8_10.2. Fixed in 2:3.28.1-3.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yelp is a help browser designed for the GNOME desktop environment, facilitating access to various documentation types, including man pages, info pages, and DocBook documentation. It serves as a central tool for users to navigate system documentation efficiently. The recent vulnerability affects the Yelp package, specifically its overly permissive Content Security Policy, which can lead to security risks for users running Flatpak applications.
Vulnerability Detail
The vulnerability, identified as CVE-2026-13601, stems from an overly permissive Content Security Policy (CSP) in the Yelp application. This flaw allows Flatpak applications to disclose sensitive host files, potentially exposing critical system information to unauthorized access. The ramifications of this vulnerability can be severe, as it may lead to data breaches or unauthorized manipulation of system files, compromising the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
2:3.28.1-3.el8_10.2
This is the first release that contains the fix.
sudo dnf update yelpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the permissions of Flatpak applications or avoid using Yelp until the package is updated to the fixed version. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The Yelp package has a critical vulnerability that can lead to host file disclosure through Flatpak applications. Users are advised to update to the patched version to mitigate risks. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to vulnerabilities using just a manifest file.
See every vulnerability recorded for yelp →
FAQ
The vulnerability allows Flatpak applications to access sensitive host files due to an overly permissive Content Security Policy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized access to sensitive system files, which can lead to data breaches and compromise system integrity.
Yes, a patch is available in version 2:3.28.1-3.el8_10.2 of the Yelp package.
If immediate updating is not possible, consider restricting Flatpak application permissions or temporarily avoiding the use of Yelp.
Related vulnerabilities
Recent vulnerabilities recorded for yelp.
