From f88dd01e70548a3b6fd2252d1234ec82e134203b Mon Sep 17 00:00:00 2001
From: David King <dking@redhat.com>
Date: Tue, 7 Jul 2026 11:03:33 +0100
Subject: [PATCH] Fix CVE-2026-13601 (RHEL-190225)

Resolves: RHEL-190225
---
 yelp-40.3-fix-CVE-2026-13601.patch | 28 ++++++++++++++++++++++++++++
 yelp.spec                          |  8 +++++++-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 yelp-40.3-fix-CVE-2026-13601.patch

diff --git a/yelp-40.3-fix-CVE-2026-13601.patch b/yelp-40.3-fix-CVE-2026-13601.patch
new file mode 100644
index 0000000..164b4f8
--- /dev/null
+++ b/yelp-40.3-fix-CVE-2026-13601.patch
@@ -0,0 +1,28 @@
+From d4a066ca32ba110d2e484579e26a54418cc4e901 Mon Sep 17 00:00:00 2001
+From: Shaun McCance <shaunm@redhat.com>
+Date: Wed, 6 May 2026 12:12:57 -0400
+Subject: [PATCH] Don't allow loading external resources from web pages
+
+This is an attack vector for sending data places.
+---
+ libyelp/web-extension/yelp-web-extension.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/libyelp/web-extension/yelp-web-extension.c b/libyelp/web-extension/yelp-web-extension.c
+index c835021d..731e006b 100644
+--- a/libyelp/web-extension/yelp-web-extension.c
++++ b/libyelp/web-extension/yelp-web-extension.c
+@@ -74,6 +74,10 @@ web_page_send_request (WebKitWebPage     *web_page,
+     const gchar *resource_uri = webkit_uri_request_get_uri (request);
+     gchar *yelp_uri, *file_path;
+ 
++    /* Don't allow loading external resources at all, for security */
++    if (g_str_has_prefix (resource_uri, "http://") || g_str_has_prefix (resource_uri, "https://"))
++        return TRUE;
++
+     if (!current_uri)
+         return FALSE;
+ 
+-- 
+2.55.0
+
diff --git a/yelp.spec b/yelp.spec
index 5dffb74..2f4c6b5 100644
--- a/yelp.spec
+++ b/yelp.spec
@@ -3,7 +3,7 @@
 Name:          yelp
 Epoch:         2
 Version:       40.3
-Release:       3%{?dist}
+Release:       4%{?dist}
 Summary:       Help browser for the GNOME desktop
 
 License:       LGPLv2+ and ASL 2.0 and GPLv2+
@@ -14,6 +14,9 @@ Source:        https://download.gnome.org/sources/%{name}/40/%{name}-%{tarball_v
 Patch1:        0001-Center-new-windows.patch
 # https://issues.redhat.com/browse/RHEL-85927
 Patch2:        yelp-CVE-2025-3155.patch
+# https://redhat.atlassian.net/browse/RHEL-190225
+# https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
+Patch3:        yelp-40.3-fix-CVE-2026-13601.patch
 
 BuildRequires: gcc
 BuildRequires: make
@@ -95,6 +98,9 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/yelp.desktop
 
 
 %changelog
+* Tue Jul 07 2026 David King <dking@redhat.com> - 2:40.3-4
+- Fix CVE-2026-13601 (RHEL-190225)
+
 * Wed Apr 23 2025 David King <dking@redhat.com> - 2:40.3-3
 - Fix CVE-2025-3155 (RHEL-85927)