CVE-2022-23853

Name: CVE-2022-23853
Creator: NVD / NIST
Published: 2022-02-11T18:15:11.85+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 0.88%

Last modified Jun 17, 2026

CVE-2022-23853 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). EPSS estimates a 0.88% chance of exploitation in the next 30 days.

Description

The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

0.88%

54.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-427

Affected Software

Vendor	Product	Versions
Kde	Kate	< 21.12.2
Kde	Ktexteditor	< 5.91.0

References

https://apps.kde.org/kate/Product, Vendor Advisory
https://kde.org/info/security/advisory-20220131-1.txtVendor Advisory
https://security.gentoo.org/glsa/202401-21
https://apps.kde.org/kate/Product, Vendor Advisory
https://kde.org/info/security/advisory-20220131-1.txtVendor Advisory
https://security.gentoo.org/glsa/202401-21

Timeline

Published: Feb 11, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-23853?

How severe is CVE-2022-23853?

CVE-2022-23853 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.88% probability of exploitation in the next 30 days.

How do I fix CVE-2022-23853?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-23853?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST