PT-2026-35678 · Kde · Kcoreaddons

Felix Boulet · Published 2026-04-28 · Updated 2026-05-05 · CVE-2026-41526

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KDE KCoreAddons versions prior to 6.25

Description The KShell::quoteArgs() function is designed to safely quote arguments for shell commands. However, it fails to adequately handle metacharacters, which can lead to a shell escape. Applications using this method in security-critical paths to process user input are susceptible. Specifically, since sendInput() transmits strings to a terminal, a control character such as x01 can be utilized during the injection process.

Recommendations Update to version 6.25 or later.

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-41526

Affected Products

Kcoreaddons

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41526 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41526 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41526 · Security Note
• https://ubuntu.com/security/CVE-2026-41526 · Vendor Advisory
• https://kde.org/info/security/advisory-20260427-1.txt · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41526 · Vendor Advisory
• https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L43-L49 · Note
• https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L168 · Note
• https://github.com/KDE/kcoreaddons/releases/tag/v6.25.0 · Note
• https://twitter.com/VulmonFeeds/status/2049139641144508880 · Twitter Post
• https://t.me/cveNotify/162210 · Telegram Post
• https://t.me/CVEtracker/52056 · Telegram Post
• https://invent.kde.org/frameworks/kcoreaddons · Note
• https://twitter.com/vuldb/status/2049343963153502629 · Twitter Post