CVE-2025-49091
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
- EPSS probability
- 0.62%
- CWE
- CWE-670
- Published
- 2025-06-11
- Last modified
- 2026-03-13
Affected products
- KDE Konsole
Weakness type
Related vulnerabilities
- CVE-2026-55624 — MintyItanium Lost-Auction takes items like barrier blocks out from search GUI
- CVE-2026-72705 — Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
- CVE-2026-72704 — Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
- CVE-2026-72703 — Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
- CVE-2026-19487 — Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
- CVE-2026-73283 — In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be...
- CVE-2026-20713 — Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors...
- CVE-2026-14935 — Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check