CVE-2024-23749

published 2024-02-09

CVE-2024-23749: KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation…

Priority P3 54 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

EXPLOIT

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
9bis	kitty	<= 0.76.1.13	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77