Command Injection Vulnerability in KDE KCoreAddons Affects User Input Handling

CVE-2026-41526

What is CVE-2026-41526?

KDE KCoreAddons prior to version 6.25 contains a vulnerability in the KShell::quoteArgs function, which is designed to securely quote arguments for shell commands. The function's failure to properly handle metacharacters allows attackers to escape the shell context, potentially leading to command injection. This issue can be exploited particularly through the sendInput() method, enabling malicious control characters to be injected into a terminal command. Applications that rely on this function for security-sensitive user input are at risk of exploitation, emphasizing the need for immediate updates and code review.

References