CVE-2026-42851
published 2026-06-12CVE-2026-42851: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded…
PriorityP341high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.19%
8.5th percentile
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kovidgoyal | kitty | < 0.47.0 | 0.47.0 |
| ubuntu | kitty | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
kovidgoyal kitty up to 0.46.x code injection (GHSA-w98g-hpvr-r332 / EUVD-2026-36555)
vuldb·2026-06-12·CVSS 7.8
CVE-2026-42851 [HIGH] kovidgoyal kitty up to 0.46.x code injection (GHSA-w98g-hpvr-r332 / EUVD-2026-36555)
A vulnerability labeled as critical has been found in kovidgoyal kitty up to 0.46.x. The impacted element is an unknown function. The manipulation results in code injection.
This vulnerability is cataloged as CVE-2026-42851. The attack must be initiated from a local position. There is no exploit available.
The affected component should be upgraded.
Ubuntu
kitty vulnerabilities
vendor_ubuntu·2026-09-15·CVSS 8.8
CVE-2026-42851 [HIGH] kitty vulnerabilities
Title: kitty vulnerabilities
Summary: Several security issues were fixed in kitty.
It was discovered that kitty incorrectly escaped error messages when
handling specially crafted terminal escape sequences. A remote attacker
could possibly use this issue to execute arbitrary commands.
(CVE-2026-42850)
It was discovered that kitty incorrectly handled remote edit requests in
terminal output. An attacker could possibly use this issue to execute
arbitrary code with the user's privileges.
(CVE-2026-42851)
Thai Son Dinh and Nguyen Huy Vu Dung discovered that kitty incorrectly
handled destination paths in its file transmission protocol. A local
attacker could possibly use this issue to overwrite arbitrary files with
the user's privileges.
(CVE-2026-54055)
It was discovered that kitty incorrec
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output [epel-all]
bugzilla·2026-06-12·CVSS 7.8
CVE-2026-42851 [HIGH] CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output [epel-all]
CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output
bugzilla·2026-06-12·CVSS 7.8
CVE-2026-42851 [HIGH] CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output
CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
Bugzilla
CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output [fedora-all]
bugzilla·2026-06-12·CVSS 7.8
CVE-2026-42851 [HIGH] CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output [fedora-all]
CVE-2026-42851 kitty: Kitty: Arbitrary code execution via crafted terminal output [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
2026-06-12
Published