CVE-2026-41526

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.

• CWE-150

• https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L168Product
• https://github.com/KDE/kcoreaddons/blob/50d360736c399502fedf203e95482b0d0e5a3ea2/src/lib/util/kshell.h#L43-L49Product
• https://github.com/KDE/kcoreaddons/releases/tag/v6.25.0Release Notes
• https://invent.kde.org/frameworks/kcoreaddons/Product
• https://kde.org/info/security/advisory-20260427-1.txtVendor Advisory

Published

Apr 28, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41520Cilium is a networking, observability, and security solution…4.4
• CVE-2026-41521xrdp is an open source RDP server. Versions 0.10.6 and prior…9.1
• CVE-2026-41522Iris is a web collaborative platform that helps incident res…7.1
• CVE-2026-41523vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-41524Brave CMS is an open-source CMS. Prior to commit 6c56603, pa…8.7
• CVE-2026-41525KDE Dolphin before 25.12.3 allows applications in a Flatpak …6.5
• CVE-2026-41527KDE Kleopatra before 26.08.0 on Windows allows local users t…6.9
• CVE-2026-4153GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code…7.8
• CVE-2026-41530The automatic folder creation feature of Lhaz and Lhaz+ prov…4.6
• CVE-2026-41539A cross-site scripting (XSS) vulnerability has been reported…6.1
• CVE-2026-4154GIMP XPM File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-4155ChargePoint Home Flex Inclusion of Sensitive Information in …7.5