KShell::quoteArgs in KDE KCoreAddons was designed to wrap command line arguments but does not correctly escape all metacharacters. This flaw allows an attacker to craft input that escapes the intended shell context, using characters such as \x01. The result is that arbitrary shell commands can be injected where the function is used, potentially executing code with the privileges of the application. This is a classic shell injection flaw described by CWE-150.

KDE KCoreAddons under the KDE:KCoreAddons vendor is affected in all releases prior to version 6.25. Any application that calls KShell::quoteArgs in a security‑critical path, especially those that forward user input to a terminal via sendInput(), is at risk.

The CVSS score of 6.5 indicates moderate severity, but the lack of an available EPSS score means the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need local or application level access to provide malicious input; the flaw does not expose a network‑exposed attack vector. Nevertheless, because the vulnerability can result in arbitrary command execution, it should be treated with caution.