diff --git a/pkgs/development/python-modules/pykde4/kdelibs.nix b/pkgs/development/python-modules/pykde4/kdelibs.nix
index 7c21be17e65c..e6f20b8248b8 100644
--- a/pkgs/development/python-modules/pykde4/kdelibs.nix
+++ b/pkgs/development/python-modules/pykde4/kdelibs.nix
@@ -1,5 +1,5 @@
 {
-  stdenv, fetchurl,
+  stdenv, fetchurl, fetchpatch,
   automoc4, cmake_2_8, libxslt, perl, pkgconfig, shared-mime-info,
   attica, docbook_xml_dtd_42, docbook_xsl, giflib,
   libdbusmenu_qt, libjpeg, phonon, qt4, openssl
@@ -12,6 +12,14 @@ stdenv.mkDerivation rec {
     url = "mirror://kde/stable/applications/17.08.3/src/${pname}-${version}.tar.xz";
     sha256 = "1zn3yb09sd22bm54is0rn98amj0398zybl550dp406419sil7z9p";
   };
+  patches = [
+    # https://phabricator.kde.org/D22989
+    (fetchpatch {
+      url = "https://cgit.kde.org/kdelibs.git/patch/?id=2c3762feddf7e66cf6b64d9058f625a715694a00";
+      sha256 = "1wbzywh8lcc66n6y3pxs18h7cwkq6g216faz27san33jpl8ra1i9";
+      name = "CVE-2019-14744.patch";
+    })
+  ];
 
   enableParallelBuilding = true;