High severity7.4NVD Advisory· Published Apr 3, 2025· Updated Jun 29, 2026

CVE-2025-3155

Description

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GNOME Foundation/Yelpinferred3 versions
(expand)+ 2 more
- (no CPE)
- cpe:2.3:a:gnome:yelp:42.2-8:*:*:*:*:*:*:*
- (no CPE)
Red Hat/Codeready Linux Builder For X86 642 versions
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
Red Hat/Codeready Linux Builder For X86 64 Eus2 versions
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*
Red Hat/Codeready Linux Builder For Arm64 Eus10 versions
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.8_aarch64:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.8_aarch64:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Red Hat/Codeready Linux Builder For Eus3 versions
cpe:2.3:a:redhat:codeready_linux_builder_for_eus:8.8:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:redhat:codeready_linux_builder_for_eus:8.8:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.4:*:*:*:*:*:*:*
Red Hat/Codeready Linux Builder For Ibm Z Systems2 versions
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Red Hat/Codeready Linux Builder For Ibm Z Systems Eus4 versions
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Debian/linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus3 versions
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Arm 644 versions
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.8_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2_aarch64:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems Eus6 versions
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Ibm Z Systems2 versions
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian2 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux For Power Little Endian Eus4 versions
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus6 versions
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus3 versions
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Update Services For Sap Solutions6 versions
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
osv-coords15 versions
pkg:rpm/almalinux/yelp pkg:rpm/almalinux/yelp-devel pkg:rpm/almalinux/yelp-libs pkg:rpm/almalinux/yelp-xsl pkg:rpm/opensuse/yelp&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/yelp&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/yelp-xsl&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/yelp-xsl&distro=openSUSE%20Tumbleweed pkg:rpm/suse/yelp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/yelp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/yelp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/yelp&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/yelp-xsl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/suse/yelp-xsl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/yelp-xsl&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
< 2:40.3-2.el9_6.1+ 14 more
- (no CPE)range: < 2:40.3-2.el9_6.1
- (no CPE)range: < 2:40.3-2.el9_6.1
- (no CPE)range: < 2:40.3-2.el9_6.1
- (no CPE)range: < 3.28.0-2.el8_10.1
- (no CPE)range: < 42.2-150600.3.3.1
- (no CPE)range: < 42.2-4.1
- (no CPE)range: < 41.1-150400.3.3.1
- (no CPE)range: < 42.1-2.1
- (no CPE)range: < 42.2-150600.3.3.1
- (no CPE)range: < 42.2-150600.3.3.1
- (no CPE)range: < 3.20.1-7.3.1
- (no CPE)range: < 3.20.1-7.3.1
- (no CPE)range: < 41.1-150400.3.3.1
- (no CPE)range: < 41.1-150400.3.3.1
- (no CPE)range: < 3.20.1-6.3.1

Patches

Vulnerability mechanics

References

bugzilla.redhat.com/show_bug.cginvdExploitIssue TrackingThird Party Advisory
gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2nvdExploitThird Party Advisory
access.redhat.com/errata/RHSA-2025:4450nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:4451nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:4455nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:4456nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:4457nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:4505nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:4532nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:7430nvdThird Party Advisory
access.redhat.com/errata/RHSA-2025:7569nvdThird Party Advisory
access.redhat.com/security/cve/CVE-2025-3155nvdThird Party Advisory
www.openwall.com/lists/oss-security/2025/04/04/1nvdMailing List
lists.debian.org/debian-lts-announce/2025/05/msg00036.htmlnvdMailing List
lists.debian.org/debian-lts-announce/2025/05/msg00037.htmlnvdMailing List
gitlab.gnome.org/GNOME/yelp/-/issues/221nvd

News mentions

No linked articles in our index yet.

cvss	0.481
epss	0.010
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000