Description
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
KDE Konsole
Default version status: unaffected
0 to < 25.04.2affected
References
- https://invent.kde.org/utilities/konsole/-/tags ↗
- https://konsole.kde.org/changelog.html ↗
- https://www.openwall.com/lists/oss-security/2025/06/10/5 ↗
- https://invent.kde.org/utilities/konsole/-/commit/09d20dea109050b4c02fb73095f327b5642a2b75 ↗
- https://kde.org/info/security/advisory-20250609-1.txt ↗
- https://proofnet.de/publikationen/konsole_rce.html ↗
- https://lists.debian.org/debian-lts-announce/2025/06/msg00019.html ↗