Skip to content
OpenAdvisories
High · 7.8 CVE-2026-42851 EUVD-2026-36555

@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

Published Jun 12, 2026 · Updated Jun 16, 2026 · Assigned by GitHub_M

Description

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

Affected products

VendorProductAffectedFixed
kovidgoyal kitty < 0.47.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 kitty 0.47.0-1 —
Debian 13 kitty 0.41.1-2+deb13u2 —
Debian 12 kitty No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 kitty No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS kitty 0.45.0-1ubuntu0.1~esm2 USN-8763-1
Ubuntu Pro 24.04 LTS kitty 0.32.2-1ubuntu0.4+esm2 USN-8763-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kitty 0.48.2-bp160.1.1 openSUSE-SU-2026:21599-1

Advisories 2

References