KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
https://security.gentoo.org/glsa/202007-47
https://lists.debian.org/debian-lts-announce/2021/12/msg00019.html
https://lists.debian.org/debian-lts-announce/2020/03/msg00033.html
https://kde.org/info/security/advisory-20200312-1.txt