The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.
Gentoo Linux Security Advisory 202008-21 - A vulnerability in Kleopatra allows arbitrary execution of code. Versions less than 20.04.3-r1 are affected.