CVE-2026-54057
published 2026-06-12CVE-2026-54057: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.17%
6.5th percentile
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kovid_goyal | kitty | >= 0.47.3 < 0.49.0 | 0.49.0 |
| kovidgoyal | kitty | < 0.47.3 | 0.47.3 |
| ubuntu | kitty | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_ubuntu8.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
vendor_redhat·2026-09-25·CVSS 7.8
CVE-2026-95832 [HIGH] CWE-78 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echo
Ubuntu
kitty vulnerabilities
vendor_ubuntu·2026-09-15·CVSS 8.8
CVE-2026-42851 [HIGH] kitty vulnerabilities
Title: kitty vulnerabilities
Summary: Several security issues were fixed in kitty.
It was discovered that kitty incorrectly escaped error messages when
handling specially crafted terminal escape sequences. A remote attacker
could possibly use this issue to execute arbitrary commands.
(CVE-2026-42850)
It was discovered that kitty incorrectly handled remote edit requests in
terminal output. An attacker could possibly use this issue to execute
arbitrary code with the user's privileges.
(CVE-2026-42851)
Thai Son Dinh and Nguyen Huy Vu Dung discovered that kitty incorrectly
handled destination paths in its file transmission protocol. A local
attacker could possibly use this issue to overwrite arbitrary files with
the user's privileges.
(CVE-2026-54055)
It was discovered that kitty incorrec
GHSA
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the termin
ghsa_unreviewed·2026-09-25·CVSS 7.8
CVE-2026-95832 [HIGH] CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the termin
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and
VulDB
kovidgoyal kitty up to 0.47.2 code injection (GHSA-5gmr-9gwg-hhq6 / Nessus ID 320963)
vuldb·2026-06-13·CVSS 7.3
CVE-2026-54057 [HIGH] kovidgoyal kitty up to 0.47.2 code injection (GHSA-5gmr-9gwg-hhq6 / Nessus ID 320963)
A vulnerability was found in kovidgoyal kitty up to 0.47.2 and classified as critical. This vulnerability affects unknown code. Executing a manipulation can lead to code injection.
This vulnerability is registered as CVE-2026-54057. The attack needs to be launched locally. No exploit is available.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in
Bugzilla
CVE-2026-95832 gum: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 gum: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
CVE-2026-95832 gum: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in ki
Bugzilla
CVE-2026-95832 golang-github-task: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 golang-github-task: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
CVE-2026-95832 golang-github-task: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_t
Bugzilla
CVE-2026-95832 vhs: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 vhs: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
CVE-2026-95832 vhs: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in ki
Bugzilla
CVE-2026-95832 gh: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [epel-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 gh: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [epel-all]
CVE-2026-95832 gh: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty
Bugzilla
CVE-2026-95832 gh: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 gh: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
CVE-2026-95832 gh: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kit
Bugzilla
CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [epel-all]
bugzilla·2026-09-28·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [epel-all]
CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in ki
Bugzilla
CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
bugzilla·2026-09-25·CVSS 7.8
CVE-2026-95832 [HIGH] CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
CVE-2026-95832 kitty: Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the fie
Bugzilla
CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply [epel-all]
bugzilla·2026-06-12·CVSS 7.3
CVE-2026-54057 [HIGH] CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply [epel-all]
CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply
bugzilla·2026-06-12·CVSS 7.3
CVE-2026-54057 [HIGH] CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply
CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
Bugzilla
CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply [fedora-all]
bugzilla·2026-06-12·CVSS 7.3
CVE-2026-54057 [HIGH] CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply [fedora-all]
CVE-2026-54057 kitty: Kitty: Arbitrary code execution via OSC 21 color-control query reply [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
2026-06-12
Published