Summary
It was discovered that kitty incorrectly escaped error messages when
handling specially crafted terminal escape sequences. A remote attacker
could possibly use this issue to execute arbitrary commands.
(CVE-2026-42850)
It was discovered that kitty incorrectly handled remote edit requests in
terminal output. An attacker could possibly use this issue to execute
arbitrary code with the user's privileges.
(CVE-2026-42851)
Thai Son Dinh and Nguyen Huy Vu Dung discovered that kitty incorrectly
handled destination paths in its file transmission protocol. A local
attacker could possibly use this issue to overwrite arbitrary files with
the user's privileges.
(CVE-2026-54055)
It was discovered that kitty incorrectly sanitized responses to color
queries. An attacker could possibly use this issue to execute arbitrary
commands with the user's privileges. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-54057)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | kitty | 0.32.2-1ubuntu0.4+esm2 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | kitty | 0.45.0-1ubuntu0.1~esm2 |
Vulnerabilities 4
-
High 7.8
@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. —…
-
High 7.4
Kitty has a shell command injection
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed…
-
High 7.3
Kitty vulnerable to command injection via unsanitized OSC 21 query reply
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
-
Medium 5.0
Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by …