7 results · Clear filters · Feed
-
Medium 5.6
Missing ownership check on the shared memory object named by the kitty askpass escape code
Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty…
-
Medium 4.6
Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c …
-
Medium 6.0
Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop
Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, beca…
-
Medium 6.8
Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process
Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c a…
-
Medium 4.6
Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory
Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, becau…
-
Medium 5.0
Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by …
-
Medium 4.1CVE-2025-43929 Public exploit
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that m…