Summary
It was discovered that KCoreAddons incorrectly handled shell argument
quoting in KShell::quoteArgs. The parsing did not adequately handle shell
metacharacters, which could lead to a shell escape. An attacker could
possibly use this issue to execute arbitrary commands in applications that
relied on this method to handle user input.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | kf6-kcoreaddons | 6.24.0-0ubuntu1.1 |
Vulnerabilities 1
-
Medium 6.5
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a…
References
-
report
https://ubuntu.com/security/CVE-2026-41526