CVE-2025-3155
HighCVSS 7.4Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A flaw was found in the Gnome help application (Yelp) that allows arbitrary script execution from help documents. This vulnerability enables malicious users to inject help documents that may exfiltrate user files to an external environment.
Risk Assessment
The risk involves potential theft of sensitive user files by an attacker delivering a crafted help document. This could lead to data leakage and privacy breaches.
Recommendation
Immediately update Yelp to the latest version containing the security fix. Until the update is applied, restrict access to help documents from untrusted sources.
Original NVD description (English source)
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.