Log in Start free

Vulnerability · Published Feb 11, 2022 · Assigned by mitre

CVE-2022-23853

High 7.8

In plain English

A high-severity security flaw in the kate package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.9%top 40.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12kate4:21.12.2-1DEBIAN-CVE-2022-23853
Debian:13kate4:21.12.2-1DEBIAN-CVE-2022-23853
Debian:14kate4:21.12.2-1DEBIAN-CVE-2022-23853
Debian:12ktexteditor5.93.0-1DEBIAN-CVE-2022-23853
Debian:13ktexteditor5.93.0-1DEBIAN-CVE-2022-23853
Debian:14ktexteditor5.93.0-1DEBIAN-CVE-2022-23853
Ubuntu:22.04:LTSkateno fix listedUBUNTU-CVE-2022-23853
Ubuntu:24.04:LTSkateno fix listedUBUNTU-CVE-2022-23853
Ubuntu:25.10kateno fix listedUBUNTU-CVE-2022-23853
Ubuntu:26.04:LTSkateno fix listedUBUNTU-CVE-2022-23853
Ubuntu:26.10kateno fix listedUBUNTU-CVE-2022-23853
Ubuntu:22.04:LTSktexteditorno fix listedUBUNTU-CVE-2022-23853
Ubuntu:24.04:LTSktexteditorno fix listedUBUNTU-CVE-2022-23853
Ubuntu:25.10ktexteditorno fix listedUBUNTU-CVE-2022-23853
Ubuntu:26.04:LTSktexteditorno fix listedUBUNTU-CVE-2022-23853
Ubuntu:26.10ktexteditorno fix listedUBUNTU-CVE-2022-23853

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References