KDE 4/5 is vulnerable to a command injection vulnerability in the KDesktopFile class.
Some of the entries in this tag include Icon, Name, etc.
The exploit is dependent on the entry that gets read by the KConfigGroup::readEntry() function.
Meanwhile, the KDE team have acknowledged the vulnerability and are currently working on a fix.
source: www.techworm.net
