CVE-2026-42850
published 2026-06-12CVE-2026-42850: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special…
PriorityP351high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.41%
33.4th percentile
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kovidgoyal | kitty | < 0.47.0 | 0.47.0 |
| ubuntu | kitty | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
kitty vulnerabilities
vendor_ubuntu·2026-09-15·CVSS 8.8
CVE-2026-42851 [HIGH] kitty vulnerabilities
Title: kitty vulnerabilities
Summary: Several security issues were fixed in kitty.
It was discovered that kitty incorrectly escaped error messages when
handling specially crafted terminal escape sequences. A remote attacker
could possibly use this issue to execute arbitrary commands.
(CVE-2026-42850)
It was discovered that kitty incorrectly handled remote edit requests in
terminal output. An attacker could possibly use this issue to execute
arbitrary code with the user's privileges.
(CVE-2026-42851)
Thai Son Dinh and Nguyen Huy Vu Dung discovered that kitty incorrectly
handled destination paths in its file transmission protocol. A local
attacker could possibly use this issue to overwrite arbitrary files with
the user's privileges.
(CVE-2026-54055)
It was discovered that kitty incorrec
VulDB
kovidgoyal kitty up to 0.46.x command injection (GHSA-p64q-59hq-5q65 / EUVD-2026-36553)
vuldb·2026-06-12·CVSS 7.4
CVE-2026-42850 [HIGH] kovidgoyal kitty up to 0.46.x command injection (GHSA-p64q-59hq-5q65 / EUVD-2026-36553)
A vulnerability, which was classified as critical, has been found in kovidgoyal kitty up to 0.46.x. The impacted element is an unknown function. Performing a manipulation results in command injection.
This vulnerability is reported as CVE-2026-42850. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error [epel-all]
bugzilla·2026-06-12·CVSS 7.4
CVE-2026-42850 [HIGH] CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error [epel-all]
CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error [fedora-all]
bugzilla·2026-06-12·CVSS 7.4
CVE-2026-42850 [HIGH] CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error [fedora-all]
CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error
bugzilla·2026-06-12·CVSS 7.4
CVE-2026-42850 [HIGH] CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error
CVE-2026-42850 kitty: Kitty: Arbitrary code execution via command injection through unescaped error
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.
2026-06-12
Published