CVE-2025-3155

HIGH

Yelp - Arbitrary Script Execution via Help Document

Title source: llm
STIX 2.1

Description

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

References (15)

Core 15
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4450
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4451
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4455
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4456
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4457
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4505
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:4532
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:7430
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:7569
Third Party Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-3155
Exploit, Issue Tracking, Third Party Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2357091

Scores

CVSS v3 7.4
EPSS 0.0104
EPSS Percentile 77.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (50)
debian/debian_linux 11.0
gnome/yelp 42.2-8
redhat/codeready_linux_builder 8.0
redhat/codeready_linux_builder 9.0
redhat/codeready_linux_builder_for_arm64 8.0_aarch64
redhat/codeready_linux_builder_for_arm64 9.0_aarch64
redhat/codeready_linux_builder_for_arm64_eus 8.8_aarch64
redhat/codeready_linux_builder_for_arm64_eus 9.2_aarch64
redhat/codeready_linux_builder_for_arm64_eus 9.4_aarch64
redhat/codeready_linux_builder_for_arm64_eus 9.6_aarch64
... and 40 more
Published Apr 03, 2025
Tracked Since Feb 18, 2026