Secuno
ENNL
Book demo

CVE-2025-3155

Gnome Yelp vulnerability

7.4 HIGHPublic exploitEPSS 13.1%
  1. Published3 Apr 2025

Description

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products

Gnome Yelp42.2-8
Redhat Codeready Linux Builder8.0 · 9.0
Redhat Codeready Linux Builder For Arm648.0_aarch64 · 9.0_aarch64
Redhat Codeready Linux Builder For Arm64 Eus8.8_aarch64 · 9.2_aarch64 · 9.4_aarch64 · 9.6_aarch64
Redhat Codeready Linux Builder For Eus8.8 · 9.2 · 9.4
Redhat Codeready Linux Builder For Ibm Z Systems8.0_s390x · 9.0_s390x
Redhat Codeready Linux Builder For Ibm Z Systems Eus8.8_s390x · 9.2_s390x · 9.4_s390x · 9.6_s390x
Redhat Codeready Linux Builder For Power Little Endian8.0_ppc64le · 9.0_ppc64le
Redhat Codeready Linux Builder For Power Little Endian Eus8.8_ppc64le · 9.2_ppc64le · 9.4_ppc64le · 9.6_ppc64le
Debian Linux11.0
Redhat Enterprise Linux8.0 · 9.0
Redhat Enterprise Linux Eus9.2 · 9.4 · 9.6
Redhat Enterprise Linux For Arm 648.0 · 8.8_aarch64 · 9.0_aarch64 · 9.2_aarch64
Redhat Enterprise Linux For Arm 64 Eus9.4_aarch64 · 9.6_aarch64
Redhat Enterprise Linux For Ibm Z Systems8.0_s390x · 9.0_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus8.8_s390x · 9.2_s390x · 9.4_s390x · 9.6_s390x
Redhat Enterprise Linux For Power Little Endian8.0_ppc64le · 9.0_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus8.8_ppc64le · 9.2_ppc64le · 9.4_ppc64le · 9.6_ppc64le
Redhat Enterprise Linux Server Aus8.2 · 8.4 · 8.6 · 9.2
Redhat Enterprise Linux Server Tus8.4 · 8.6 · 8.8
Redhat Enterprise Linux Update Services For Sap Solutions8.4 · 8.6 · 8.8 · 9.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

and 6 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1082619.3
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app…
CVE-2026-1011528.0
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote,…
CVE-2026-1010909.8
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect…
CVE-2026-546189.4
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0,…
CVE-2026-540729.3
Authorizer is an open-source, self-hostable authentication and authorization server.…
CVE-2026-888878.6
Renovate is a dependency update automation tool. When listing tags/digests for a…

Frequently asked

Is CVE-2025-3155 being actively exploited?

CVE-2025-3155 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 13.1%.

How severe is CVE-2025-3155?

CVE-2025-3155 has a CVSS 3.1 base score of 7.4, rated high. EPSS estimates a 13.1% probability of exploitation.

Which products are affected by CVE-2025-3155?

Affected products include Gnome Yelp, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder For Arm64, Redhat Codeready Linux Builder For Arm64 Eus, Redhat Codeready Linux Builder For Eus, and 16 more.

How do I fix CVE-2025-3155?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-3155 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.