In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8857-1 advisory.

    It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The     parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker     could possibly use this issue to execute arbitrary commands in applications that relied on this method to     handle user input.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20701-1 advisory.

    Changes in kf6-kcoreaddons:

    - CVE-2026-41526: Fixed arbitrary code execution via improper shell argument quoting (boo#1263441)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can     be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape     from the shell. All applications relying on this method in a security-critical path to handle user input     are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a     control character such as \x01 can be used during injection. (CVE-2026-41526)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362566	Ubuntu 26.04 LTS : KCoreAddons vulnerability (USN-8857-1)	Nessus	Ubuntu Local Security Checks	Local	high
313700	openSUSE 16 Security Update : kf6-kcoreaddons (openSUSE-SU-2026:20701-1)	Nessus	SuSE Local Security Checks	Local	high
310923	Linux Distros Unpatched Vulnerability : CVE-2026-41526	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-41526

high

Tenable Plugins

high

high

high