CVE-2022-23853

The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and
KTextEditor before 5.91.0 tries to execute the associated LSP server binary
when opening a file of a given type. If this binary is absent from the
PATH, it will try running the LSP server binary in the directory of the
file that was just opened (due to a misunderstanding of the QProcess API,
that was never intended). This can be an untrusted directory.