3rd party KDE Plasma Global Themes and Widgets can lead to data loss

Uh oh. Seems there’s been an issue lately with Global Themes for KDE, which has ended up causing a total wipe of data. The issue is that KDE Global Themes can run arbitrary code, so they can really mess with your system, so you’re advised not to use them.

Writing on Mastodon the official KDE account put out a warning across multiple posts copied below:

WARNING: Global themes and widgets created by 3rd party developers for Plasma can and will run arbitrary code. You are encouraged to exercise extreme caution when using these products.

A user has had a bad experience installing a global theme on Plasma and lost personal data.

https://www.reddit.com/r/kde/comments/1bixmbx/do_not_install_global_themes_some_wipe_out_all/

Global themes change the look of Plasma, but also the behavior. To do this they run code, and this code can be faulty, as in the case mentioned above. The same goes for widgets and plasmoids.

Continuing…

We are calling on the community to help us locate and quarantine defective software by using the “Report” buttons available on each item in the KDE Store.

https://store.kde.org

Please see the attached image to locate them.

And more…

Meanwhile, KDE is taking measures to properly warn users before each download and we are also putting in place ways of auditing and curating what is uploaded to the KDE store.

https://blog.davidedmundson.co.uk/blog/kde-store-content/

Nevertheless, this will take time and resources. We recommend all users to be careful when installing and running software not provided directly by KDE or your distros.

And remember to report any faulty products you find!

As written up by David Edmundson in the blog link above, this specific case was not intentional but as a result of “a mistake in some shell parsing”. Edmundson suggests that if you have used the KDE addon store give it a look over.

Quite a problem, that’s going to need some proper long-term solutions to prevent this happening again.

Article taken from GamingOnLinux.com.