PT-2026-35678 · Kde · Kcoreaddons

Felix Boulet · CVE-2026-41526 · Published 2026-04-28 · Updated 2026-05-05

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KDE KCoreAddons versions prior to 6.25

Description The KShell::quoteArgs() function is designed to safely quote arguments for shell commands. However, it fails to adequately handle metacharacters, which can lead to a shell escape. Applications using this method in security-critical paths to process user input are susceptible. Specifically, since sendInput() transmits strings to a terminal, a control character such as x01 can be utilized during the injection process.

Recommendations Update to version 6.25 or later.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-41526

OPENSUSE-SU-2026:20701-1

Affected Products

Kcoreaddons

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41526.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-41526 · Vendor Advisory
• https://kde.org/info/security/advisory-20260427-1.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41526 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41526 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41526 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41526 · Security Note
• https://ubuntu.com/security/CVE-2026-41526 · Vendor Advisory
• https://github.com/KDE/kcoreaddons/releases/tag/v6.25.0 · Note
• https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L43-L49 · Note
• https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L168 · Note
• https://twitter.com/vuldb/status/2049343963153502629 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049139641144508880 · Twitter Post
• https://invent.kde.org/frameworks/kcoreaddons · Note