Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-28 | 1 | Disclosure1 |
| 2026-04-29 | 1 | Active Exploitation1 |
Some increased actor activities are shown targeting KDE KCoreAddons (CVE-2026-41526) https://vuldb.com/vuln/359934/cti
Post summary
The post reports increased attacker activity targeting KDE KCoreAddons CVE-2026-41526, indicating active exploitation but providing no PoC, exploit code, or patch information.
CVE-2026-41526 Shell Metacharacter Escape in KDE KCoreAddons Before 6.25 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41526
Post summary
CVE-2026-41526 is a shell metacharacter escape vulnerability found in KDE KCoreAddons versions prior to 6.25, announced through a vulnerability database link. No PoC, exploit code, active exploitation, patches, or false‑positive claims are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kde | kcoreaddons | - | - | - |