Description
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| KDE | KCoreAddons | < 6.25 | 6.25 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kcoreaddons | 5.116.0-2 | — |
| Debian 14 | kf6-kcoreaddons | 6.26.0-1 | — |
| Debian 13 | kcoreaddons +1 | No fix yet | — |
| Debian 12 | kcoreaddons | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | kcoreaddons | No fix yet | — |
| Ubuntu 26.04 LTS | kcoreaddons | No fix yet | — |
| Ubuntu 26.04 LTS | kf6-kcoreaddons | 6.24.0-0ubuntu1.1 | USN-8857-1 |
| Ubuntu 25.10 | kcoreaddons +1 | No fix yet | — |
| Ubuntu 24.04 LTS | kcoreaddons | No fix yet | — |
| Ubuntu 22.04 LTS | kcoreaddons | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | kcoreaddons | No fix yet | — |
| Ubuntu 18.04 LTS | kcoreaddons | No fix yet | — |
| Ubuntu 16.04 LTS | kcoreaddons | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kf-kcoreaddons | 5.249.0-2 | — |
Advisories 2
- USN-8857-1 kf6-kcoreaddons vulnerability Ubuntu Security Notices (USN) · Oct 2, 2026
- WID-SEC-2026-1293 KDE (Dolphin und KShell): Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Oct 1, 2026
References
- https://invent.kde.org/frameworks/kcoreaddons/
- https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L43-L49
- https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L168
- https://github.com/KDE/kcoreaddons/releases/tag/v6.25.0
- https://kde.org/info/security/advisory-20260427-1.txt