CVE-2026-41526: High severity KDE KCoreAddons vulnerability
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41526?
CVE-2026-41526 has a critical severity rating due to the potential for unauthorized command execution.
How do I fix CVE-2026-41526?
To address CVE-2026-41526, upgrade KDE KCoreAddons to version 6.25 or later.
What causes CVE-2026-41526?
CVE-2026-41526 is caused by inadequate handling of metacharacters in the KShell::quoteArgs function.
Who is affected by CVE-2026-41526?
All applications that rely on the KShell::quoteArgs method in security-critical paths are affected by CVE-2026-41526.
What applications are vulnerable due to CVE-2026-41526?
Applications that use KDE KCoreAddons versions before 6.25 are vulnerable to CVE-2026-41526.