KDE Plasma Affected By Arbitrary Code Execution To Break Sandboxes With "Open New Window"

A security researcher (Kimiblock) discovered an arbitrary code execution vulnerability in KDE Plasma that allows sandboxed applications (e.g., Flatpak apps) to escape their sandbox and spawn arbitrary binaries on the host system. The exploit is triggered via Plasma's 'Open New Window' action, such as a middle-click on the taskbar. The vulnerability was reported to the KDE security team but went unpatched and unacknowledged through the latest Plasma 6.7 release. After the standard 90-day embargo period, the researcher has publicly disclosed the full details and proof-of-concept code.