[manjaro-security] [ASA-202506-5] konsole: arbitrary code execution

[Andrea Denisse]

Arch Linux Security Advisory ASA-202506-5
=========================================

Severity: High
Date    : 2025-06-11
CVE-ID  : CVE-2025-49091
Package : konsole
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2897

Summary
=======

The package konsole before version 25.04.2-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 25.04.2-1.

# pacman -Syu "konsole>=25.04.2-1"

The problem has been fixed upstream in version 25.04.2.

Workaround
==========

None.

Description
===========

Konsole supports loading URLs from the scheme handlers such as
telnet://URL. This can be executed regardless of whether the telnet
binary is available.

In this mode konsole had a path where if telnet was not available it
would fall back to using bash for the given arguments provided; which
is the URL provided. This allows an attacker to execute arbitrary code.

Browsers typically provide a prompt when a user opens an external
scheme handler which would look suspicious, requiring user interaction
to be exploitable.

Impact
======

A remote attacker can trick a user into opening a specially crafted URL
that exploits Konsole’s scheme handler fallback mechanism, leading to
arbitrary code execution.

References
==========

https://kde.org/info/security/advisory-20250609-1.txt
https://proofnet.de/publikationen/konsole_rce.html
https://nvd.nist.gov/vuln/detail/CVE-2025-49091
https://www.openwall.com/lists/oss-security/2025/06/10/5
https://invent.kde.org/utilities/konsole/-/commit/09d20dea109050b4c02fb73095f327b5642a2b75
https://security.archlinux.org/CVE-2025-49091