Skip to content
Heist/ feed
MediumFix available

kf5-kcoreaddons security update

Type: advisorySource: OSV1 source record

KCoreAddons provides classes built on top of QtCore to perform various tasks such as manipulating mime types, autosaving files, creating backup files, generating random sequences, performing text manipulations such as macro replacement, accessing user information and many more. Security Fix(es): In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.(CVE-2026-41526)

Announced Source revision 1
Original source ↗

OESA-2026-4166

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4166

kf5-kcoreaddons

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
5.100.0-2.oe2203sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "5.100.0-2.oe2203sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "kf5-kcoreaddons",
      "purl": "pkg:rpm/openEuler/kf5-kcoreaddons&distro=openEuler-22.03-LTS-SP4",
      "ecosystem": "openEuler:22.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4166.json"
    },
    "ecosystem_specific": {
      "src": [
        "kf5-kcoreaddons-5.100.0-2.oe2203sp4.src.rpm"
      ],
      "x86_64": [
        "kf5-kcoreaddons-5.100.0-2.oe2203sp4.x86_64.rpm",
        "kf5-kcoreaddons-debuginfo-5.100.0-2.oe2203sp4.x86_64.rpm",
        "kf5-kcoreaddons-debugsource-5.100.0-2.oe2203sp4.x86_64.rpm",
        "kf5-kcoreaddons-devel-5.100.0-2.oe2203sp4.x86_64.rpm"
      ],
      "aarch64": [
        "kf5-kcoreaddons-5.100.0-2.oe2203sp4.aarch64.rpm",
        "kf5-kcoreaddons-debuginfo-5.100.0-2.oe2203sp4.aarch64.rpm",
        "kf5-kcoreaddons-debugsource-5.100.0-2.oe2203sp4.aarch64.rpm",
        "kf5-kcoreaddons-devel-5.100.0-2.oe2203sp4.aarch64.rpm"
      ]
    }
  }
]

Publisher severity

medium

Source reference: /database_specific/severity

Event
#52077 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement