The LSP (Language Server Protocol) plugin in KDE Kate prior to 21.12.2 and KTextEditor prior to 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
kde ktexteditor |
||
kde kate |
Vulmon