Catanzaro: Dangerous arbitrary file read vulnerability in Yelp

GNOME contributor Michael Catanzaro has written a blogpost about a noteworthy vulnerability in GNOME's help browser, Yelp.

I don't normally blog about particular CVEs, but Yelp CVE-2025-3155 isnoteworthy because it is quite severe, public for several weeks now,and not yet fixed upstream. In short, help files can read yourfilesystem and execute arbitrary JavaScript code, allowing an attackerto exfiltrate any files your Unix user has access to.

The vulnerability was first reported on December25, and itwas made public on March26 after the 90-day-disclosure deadlinewas reached. Patcheshave been proposed to fix the issue. The bug reporter has published a writeupdemonstrating the attack. Catanzaro asks that Linux vendors"please consider applying the provided patches even though theyhave not yet been accepted upstream".