THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-13601 (HIGH 7.1) — A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG docum

[NVD] CVE-2026-13601 (HIGH 7.1) — A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG docum

lownvdPublished 2026-06-29

CVE-2026-13601 CVSS: 7.1 HIGH Published: 2026-06-29T10:16:30.180

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's

Indicators of compromise

CVE-2026-13601cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-13601