CVE-2026-41526
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Apr 28, 2026
CISA due date
—
The record
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150
- CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in… CWE-150
- CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-150
- CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. CWE-150
- CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. CWE-150
- CVE-2026-72913 Kitty is a cross-platform GPU based terminal. CWE-150
- CVE-2026-64654 GitHub CLI (gh) is GitHub's official command line tool. CWE-150
- CVE-2026-49147 App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences… CWE-150