CVE-2026-41526: High severity KDE KCoreAddons vulnerability
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.249.0-2 - Upgrade
Upgrade
debian/kcoreaddonsto a version that resolves this vulnerability.Fixed in 5.116.0-4 - Upgrade
Upgrade
debian/kf6-kcoreaddonsto a version that resolves this vulnerability.Fixed in 6.30.0-1 - Upgrade
Upgrade
KDE KCoreAddonsto a version that resolves this vulnerability.Fixed in 6.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41526?
CVE-2026-41526 has a critical severity rating due to the potential for unauthorized command execution.
How do I fix CVE-2026-41526?
To address CVE-2026-41526, upgrade KDE KCoreAddons to version 6.25 or later.
What causes CVE-2026-41526?
CVE-2026-41526 is caused by inadequate handling of metacharacters in the KShell::quoteArgs function.
Who is affected by CVE-2026-41526?
All applications that rely on the KShell::quoteArgs method in security-critical paths are affected by CVE-2026-41526.
What applications are vulnerable due to CVE-2026-41526?
Applications that use KDE KCoreAddons versions before 6.25 are vulnerable to CVE-2026-41526.