CVE-2022-23853
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91...
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
CVE-2022-23853- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-427
- Updated
- 2026-11-02
CVE List No score
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
CVE-2022-23853- Updated
- 2026-11-02
EUVDEUVD-2022-28779 No score
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
EUVD-2022-28779- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qjh4-6jqf-7749
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91...
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
GHSA-qjh4-6jqf-7749- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-427
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-23853
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
DEBIAN-CVE-2022-23853- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-23853
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
UBUNTU-CVE-2022-23853- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSV No score
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
- Record
CVE-2022-23853- Updated
- 2026-11-02
OSVMGASA-2023-0051 No score
Updated qtbase5 packages fix security vulnerability
Avoid unintentionally using binaries from CWD (CVE-2022-23853) Fix a possible DOS involving the Qt SQL ODBC driver plugin (CVE-2023-24607) Also fixes a regression that prevented Akonadi from working with kmail
- Record
MGASA-2023-0051- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0841-1 No score
Security update for libqt5-qtbase
This update for libqt5-qtbase fixes the following issues:
- CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD (bsc#1195386, bsc#1196501).
- Record
openSUSE-SU-2022:0841-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11801-1 No score
kate-21.12.2-1.1 on GA media
These are all security issues fixed in the kate-21.12.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11801-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11813-1 No score
libQt5Bootstrap-devel-static-32bit-5.15.2+kde294-2.1 on GA media
These are all security issues fixed in the libQt5Bootstrap-devel-static-32bit-5.15.2+kde294-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11813-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0841-1 No score
Security update for libqt5-qtbase
This update for libqt5-qtbase fixes the following issues:
- CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD (bsc#1195386, bsc#1196501).
- Record
SUSE-SU-2022:0841-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kateDebian:12 |
before 4:21.12.2-1 | 4:21.12.2-1 |
kateDebian:13 |
before 4:21.12.2-1 | 4:21.12.2-1 |
kateDebian:14 |
before 4:21.12.2-1 | 4:21.12.2-1 |
ktexteditorDebian:12 |
before 5.93.0-1 | 5.93.0-1 |
ktexteditorDebian:13 |
before 5.93.0-1 | 5.93.0-1 |
ktexteditorDebian:14 |
before 5.93.0-1 | 5.93.0-1 |
qtbase5Mageia:8 From an advisory covering 2 CVEs |
before 5.15.2-4.8.mga8 | 5.15.2-4.8.mga8 |
libqt5-qtbaseSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libqt5-qtbaseSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Manager Proxy 4.1 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Manager Retail Branch Server 4.1 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Manager Server 4.1 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
libqt5-qtbaseSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
kateUbuntu:16.04:LTS |
All versions, plus listed versions 4:15.08.2-0ubuntu14:15.08.2-0ubuntu24:15.12.1-0ubuntu14:15.12.3-0ubuntu14:15.12.3-0ubuntu2 |
None known |
ktexteditorUbuntu:16.04:LTS |
All versions, plus listed versions 5.15.0-0ubuntu15.15.0-0ubuntu25.15.0-0ubuntu35.18.0-0ubuntu1 |
None known |
kateUbuntu:18.04:LTS |
All versions, plus listed versions 4:17.04.3-0ubuntu14:17.04.3-0ubuntu24:17.08.3-0ubuntu14:17.12.2-0ubuntu14:17.12.3-0ubuntu1 |
None known |
ktexteditorUbuntu:18.04:LTS |
All versions, plus listed versions 5.38.0-0ubuntu15.38.0-0ubuntu1.15.38.0-0ubuntu25.40.0-0ubuntu15.41.0-0ubuntu2 Show 4 moreShow less5.42.0-0ubuntu15.43.0-0ubuntu25.44.0-0ubuntu15.44.0-0ubuntu2 |
None known |
kateUbuntu:20.04:LTS |
All versions, plus listed versions 4:19.04.3-0ubuntu24:19.08.2-1ubuntu14:19.08.3-0ubuntu14:19.12.0-0ubuntu14:19.12.0-1ubuntu14:19.12.1-0ubuntu14:19.12.2-0ubuntu14:19.12.3-0ubuntu1 |
None known |
ktexteditorUbuntu:20.04:LTS |
All versions, plus listed versions 5.62.0-0ubuntu15.62.0-0ubuntu25.64.0-0ubuntu15.65.0-0ubuntu25.65.0-0ubuntu35.66.0-0ubuntu15.67.0-0ubuntu15.68.0-0ubuntu1 |
None known |
kateUbuntu:22.04:LTS |
All versions, plus listed versions 4:21.08.1-14:21.08.2-14:21.08.3-0ubuntu14:21.11.80-0ubuntu14:21.11.90-0ubuntu1 Show 5 moreShow less4:21.11.90-0ubuntu24:21.12.0-0ubuntu14:21.12.1-0ubuntu14:21.12.2-0ubuntu14:21.12.3-0ubuntu1 |
None known |
ktexteditorUbuntu:22.04:LTS |
All versions, plus listed versions 5.86.0-0ubuntu15.88.0-0ubuntu15.88.0-1ubuntu15.88.0-1ubuntu35.89.0-0ubuntu1 Show 4 moreShow less5.90.0-0ubuntu15.90.0-0ubuntu25.91.0-0ubuntu15.92.0-0ubuntu1 |
None known |
kateUbuntu:24.04:LTS |
All versions, plus listed versions 4:23.08.1-0ubuntu14:23.08.2-0ubuntu14:23.08.3-0ubuntu14:23.08.4-0ubuntu14:23.08.5-0ubuntu14:23.08.5-0ubuntu24:23.08.5-0ubuntu3 |
None known |
ktexteditorUbuntu:24.04:LTS |
All versions, plus listed versions 5.110.0-0ubuntu15.112.0-0ubuntu15.113.0-0ubuntu15.115.0-0ubuntu25.115.0-0ubuntu35.115.0-0ubuntu4 |
None known |
kateUbuntu:25.10 |
All versions, plus listed versions 4:24.12.3-2ubuntu24:25.04.0-0ubuntu14:25.04.1-0ubuntu14:25.04.2-0ubuntu14:25.04.2-1ubuntu1 Show 7 moreShow less4:25.04.3-0ubuntu14:25.04.3-1ubuntu14:25.07.80-0ubuntu14:25.07.90-0ubuntu14:25.08.0-0ubuntu14:25.08.1-0ubuntu14:25.08.1-0ubuntu2 |
None known |
ktexteditorUbuntu:25.10 |
All versions, plus listed versions 5.116.0-0ubuntu15.116.0-1ubuntu1 |
None known |
kateUbuntu:26.10 |
All versions, plus listed versions 4:25.12.3-0ubuntu14:26.04.0-1ubuntu14:26.04.1-0ubuntu14:26.04.2-0ubuntu14:26.04.3-0ubuntu1 Show 4 moreShow less4:26.07.90-0ubuntu14:26.08.0-0ubuntu14:26.08.0-0ubuntu24:26.08.1-0ubuntu1 |
None known |
ktexteditorUbuntu:26.10 |
All versions, plus listed versions 5.116.0-1ubuntu1 |
None known |
kateUbuntu:26.04:LTS |
All versions, plus listed versions 4:25.08.1-0ubuntu24:25.08.2-0ubuntu14:25.08.3-0ubuntu14:25.11.80-0ubuntu14:25.11.90-0ubuntu1 Show 6 moreShow less4:25.12.0-0ubuntu14:25.12.1-0ubuntu14:25.12.1-1ubuntu14:25.12.2-0ubuntu14:25.12.2-0ubuntu24:25.12.3-0ubuntu1 |
None known |
ktexteditorUbuntu:26.04:LTS |
All versions, plus listed versions 5.116.0-1ubuntu1 |
None known |
libqt5-qtbaseopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 5.12.7-4.17.1 | 5.12.7-4.17.1 |
kateopenSUSE:Tumbleweed |
before 21.12.2-1.1 | 21.12.2-1.1 |
libqt5-qtbaseopenSUSE:Tumbleweed |
before 5.15.2+kde294-2.1 | 5.15.2+kde294-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23853 is a high vulnerability (CVSS 7.8) in Kde Kate, published February 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in kate 4:21.12.2-1.
References
apps.kde.org/kate
kde.org/info/security/advisory-20220131-1.txt
security.gentoo.org/glsa/202401-21
nvd.nist.gov/vuln/detail/CVE-2022-23853
github.com/advisories/GHSA-qjh4-6jqf-7749
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2022-23853
advisories.mageia.org/MGASA-2023-0051.html
bugs.mageia.org/show_bug.cgi?id=29359
suse.com/support/update/announcement/2022/suse-su-20220841-1
bugzilla.suse.com/1195386
ubuntu.com/security/CVE-2022-23853
commits.kde.org/kate/361dd43e42994829dbdb35e78fb7698d27cbb0e2
cve.org/CVERecord?id=CVE-2022-23853
lists.opensuse.org/archives/list/[email protected]/thread/NIPE5FF5VKMSL2BZDJ46HDRCTHGR7IUG