| ID | CVE-2026-41526 | ||||||
| Sažetak | In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection. | ||||||
| Reference |
|
||||||
| CVSS |
|
||||||
| Pristup |
|
||||||
| Impact |
|
||||||
| CVSS vektor | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L | ||||||
| Zadnje važnije ažuriranje | 05-05-2026 - 17:25 | ||||||
| Objavljeno | 28-04-2026 - 08:16 |
