CVE-2026-41526 Details
Description
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
A command injection vulnerability has been identified in KDE KCoreAddons versions prior to 6.25. The issue arises in the KShell module, specifically within the argument quoting function, KShell::quoteArgs. This function is designed to safely quote arguments for shell commands, but it fails to properly handle metacharacters, allowing an escape from the quoted context. Applications that rely on this function to process user input in security-sensitive areas are vulnerable. The issue is particularly problematic in terminal applications like Dolphin and Kate, where injected control characters can disrupt the quoting and execute unintended commands.
Users can update KCoreAddons to version 6.25 or later. Alternatively, the patch provided in the KDE security advisory can be applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kde kcoreaddons | < 6.25.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 28, 2026 | New CVE Received | [email protected] |