CVE-2022-23853: High severity kde ktexteditor vulnerability
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-23853.
Which software versions are affected by this vulnerability?
This vulnerability affects KDE Kate versions up to 21.12.2 and KTextEditor versions up to 5.91.0.
What is the severity of CVE-2022-23853?
The severity of CVE-2022-23853 is high with a severity value of 7.8.
How does the vulnerability in the LSP plugin affect KDE Kate and KTextEditor?
The vulnerability in the LSP plugin allows execution of an associated LSP server binary when opening a file of a given type, which can be exploited if the binary is absent from the PATH or if a malicious binary is placed in the directory of the file.
How can I mitigate CVE-2022-23853?
To mitigate CVE-2022-23853, it is recommended to update KDE Kate to version 21.12.2 or later and KTextEditor to version 5.91.0 or later.