I love @kdecommunity and all, but this is quite the SNAFU. Oops. https://www.kde.org/info/security/advisory-20180208-2.txt …
Show this thread
-
TBF, I don't think they even have a *good* reason to be using the shell here. It seems to be passing an argument to applications at launch. That can and should be done directly as argv without shell parsing getting involved.
Might just be the freedesktop spec for desktop files requires it or something (if that's the case, it should be fixed).