MEDIUM 6.5 Microsoft

CVE-2026-41526

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.

Microsoft Security Update 2026-Apr: In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.

Affected Products

References

Published: 2026-04-14 · Source: Microsoft · Feed updated: 2026-08-10
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-04-14 via Microsoft. Affected: azl3 kf-kcoreaddons 5.249.0-1 on Azure Linux 3.0, cbl2 kf5-kcoreaddons 5.61.0-4 on CBL Mariner 2.0, azl3 kf-kcoreaddons 5.249.0-2 on Azure Linux 3.0.
vulnfeed aggregates 9044 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.