Description
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Affected products
gnome: yelp; debian: debian linux; redhat: codeready linux builder; redhat: codeready linux builder for arm64; redhat: codeready linux builder for arm64 eus; redhat: codeready linux builder for eus; redhat: codeready linux builder for ibm z systems; redhat: codeready linux builder for ibm z systems eus; redhat: codeready linux builder for power little endian; redhat: codeready linux builder for power little endian eus; redhat: enterprise linux; redhat: enterprise linux eus; redhat: enterprise linux for arm 64; redhat: enterprise linux for arm 64 eus; redhat: enterprise linux for ibm z systems
References10
- bugzilla.redhat.com/show_bug.cgi?id=2357091 ExploitIssue TrackingThird Party Advisory
- gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2 ExploitThird Party Advisory
- access.redhat.com/errata/RHSA-2025:4450 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:4451 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:4455 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:4456 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:4457 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:4505 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:4532 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:7430 Third Party Advisory
Metrics
- CVSS 3.1
-
7.4
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - EPSS — exploit probability
- 13% percentile: 96 · as of 7 November 2026
- CWE
- CWE-601
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.