CVE-2025-49091

Name	CVE-2025-49091
Description	KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4220-1, DSA-5945-1
Debian Bugs	1107672

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
konsole (PTS)	bullseye	4:20.12.3-1	vulnerable
	bullseye (security)	4:20.12.3-1+deb11u1	fixed
	bookworm, bookworm (security)	4:22.12.3-1+deb12u1	fixed
	forky, sid, trixie	4:25.04.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
konsole	source	bullseye	4:20.12.3-1+deb11u1	DLA-4220-1
konsole	source	bookworm	4:22.12.3-1+deb12u1	DSA-5945-1
konsole	source	(unstable)	4:25.04.0-2		1107672

Notes

https://www.openwall.com/lists/oss-security/2025/06/10/5
https://kde.org/info/security/advisory-20250609-1.txt
Fixed by: https://invent.kde.org/utilities/konsole/-/commit/09d20dea109050b4c02fb73095f327b5642a2b75 (v25.04.2)