vulnerability
Debian: CVE-2025-49091: konsole -- security update
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:H/Au:N/C:C/I:C/A:P) | Jun 11, 2025 | Jun 12, 2025 | Aug 15, 2025 |
Severity
7
CVSS
(AV:N/AC:H/Au:N/C:C/I:C/A:P)
Published
Jun 11, 2025
Added
Jun 12, 2025
Modified
Aug 15, 2025
Description
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Solution
debian-upgrade-konsole
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.