CVE-2025-49091 Command injection in Konsole
An attacker can execute arbitrary code by tricking a user into opening a malicious URL, as Konsole falls back to bash when specific binaries are missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-49091?
CVE-2025-49091 is a high-severity command injection vulnerability in KDE Konsole, published on 11 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code.
Weakness: CWE-670
Which versions are affected by CVE-2025-49091?
Linux distribution packages (3)
konsole Red Hat:rhel_els:7 | All versions | 0:4.10.5-5.el7_9.1 |
konsole-debuginfo Red Hat:rhel_els:7 | All versions | 0:4.10.5-5.el7_9.1 |
konsole-part Red Hat:rhel_els:7 | All versions | 0:4.10.5-5.el7_9.1 |
How do I fix CVE-2025-49091?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-49091 being exploited?
There is no known exploitation of CVE-2025-49091 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2025-49091, DLA-4220-1, DSA-5945-1, GHSA-h4f3-5vvh-xjgj, MGASA-2025-0308, RHSA-2025:12346 and 2 more.