[plasmashell] [Bug 389815] New: Possibility of code execution when opening volume which label contains `` or $() from notifications panel

[bugzilla_noreply]

https://bugs.kde.org/show_bug.cgi?id=389815

            Bug ID: 389815
           Summary: Possibility of code execution when opening volume
                    which label contains `` or $()  from notifications
                    panel
           Product: plasmashell
           Version: 5.10.5
          Platform: Debian testing
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: NOR
         Component: Notifications
          Assignee: k...@privat.broulik.de
          Reporter: ksieluzy...@gmail.com
                CC: plasma-b...@kde.org
  Target Milestone: 1.0

Hello,

When opening volume which label contains `` or $() from notifictions panel the
code gets executed. For example, opening a volume named `touch blabla` creates
a file  named blabla in user home folder. 
This happens only when opening volume from notification bar (see attachment),
not when opening it from Dolphin directly.

Regards,
Krzysztof

-- 
You are receiving this mail because:
You are watching all bug changes.