CVE-2022-23853

High

Description

The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.

SeverityHigh

CVSS7.8

Exploit probability—

ProductKde Kate

PublishedFeb 11, 2022

First seenFeb 11, 2022

How to fix

Update

kde kate21.12.2 or later
kde ktexteditor5.91.0 or later

Vendor advisories

security.gentoo.org/glsa/202401-21

Affected products

Product	Affected versions	Fixed in
kde kate	v < 21.12.2	21.12.2
kde ktexteditor	v < 5.91.0	5.91.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.