CVE-2026-54055
published 2026-06-12CVE-2026-54055: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission…
PriorityP430medium5CVSS 3.1
AVLACHPRLUIRSUCNIHAL
EPSS
0.07%
0.0th percentile
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kovidgoyal | kitty | < 0.47.2 | 0.47.2 |
| ubuntu | kitty | — | — |
CVSS provenance
nvdv3.15.0MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
kovidgoyal kitty up to 0.47.1 os.open link following (GHSA-q446-x7q6-vcxh / EUVD-2026-36556)
vuldb·2026-06-12·CVSS 5.0
CVE-2026-54055 [MEDIUM] kovidgoyal kitty up to 0.47.1 os.open link following (GHSA-q446-x7q6-vcxh / EUVD-2026-36556)
A vulnerability identified as critical has been detected in kovidgoyal kitty up to 0.47.1. This issue affects the function os.open. The manipulation leads to link following.
This vulnerability is referenced as CVE-2026-54055. The attack can only be performed from a local environment. No exploit is available.
You should upgrade the affected component.
Ubuntu
kitty vulnerabilities
vendor_ubuntu·2026-09-15·CVSS 8.8
CVE-2026-42851 [HIGH] kitty vulnerabilities
Title: kitty vulnerabilities
Summary: Several security issues were fixed in kitty.
It was discovered that kitty incorrectly escaped error messages when
handling specially crafted terminal escape sequences. A remote attacker
could possibly use this issue to execute arbitrary commands.
(CVE-2026-42850)
It was discovered that kitty incorrectly handled remote edit requests in
terminal output. An attacker could possibly use this issue to execute
arbitrary code with the user's privileges.
(CVE-2026-42851)
Thai Son Dinh and Nguyen Huy Vu Dung discovered that kitty incorrectly
handled destination paths in its file transmission protocol. A local
attacker could possibly use this issue to overwrite arbitrary files with
the user's privileges.
(CVE-2026-54055)
It was discovered that kitty incorrec
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol [epel-all]
bugzilla·2026-06-12·CVSS 5.0
CVE-2026-54055 [MEDIUM] CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol [epel-all]
CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol [fedora-all]
bugzilla·2026-06-12·CVSS 5.0
CVE-2026-54055 [MEDIUM] CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol [fedora-all]
CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol
bugzilla·2026-06-12·CVSS 5.0
CVE-2026-54055 [MEDIUM] CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol
CVE-2026-54055 kitty: Kitty: Local privilege escalation via TOCTOU race condition in file transmission protocol
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
2026-06-12
Published