CVE-2025-49091

KDE Konsole is a terminal emulator that registers handlers for remote access scheme URIs (ssh://, telnet://, rlogin://) per the XDG Desktop Entry specification. The vulnerability resides in the scheme handler implementation (CWE-670: Improper Controls for Unusual or Dangerous XML). When Konsole receives a URL like ssh://attacker.com -c 'malicious_command', it attempts to invoke the ssh binary with parsed URL components as arguments. The root cause is inadequate error handling: if the ssh binary is missing, the code does not properly validate or sanitize the remaining arguments before passing them to /bin/bash as a fallback. This violates the principle of least privilege and proper input validation. The affected component is likely in Konsole's URL parsing and process spawning logic, specifically in how it constructs command arguments for scheme handlers without proper quoting or validation of the fallback path.