CVE-2026-72913
published 2026-08-10CVE-2026-72913: Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the…
PriorityP338high7.3CVSS 4.0
AVLACLATPPRNUIPVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.21%
10.2th percentile
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| external-secrets-operator | external-secrets-rhel9 | — | — |
| kovidgoyal | kitty | < 0.48.2 | 0.48.2 |
CVSS provenance
nvdv4.07.3HIGHCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
kovidgoyal Kitty up to 0.48.1 DCS Handlers kitty/window.py handle_remote_echo os command injection
vuldb·2026-08-10·CVSS 7.3
CVE-2026-72913 [HIGH] kovidgoyal Kitty up to 0.48.1 DCS Handlers kitty/window.py handle_remote_echo os command injection
A vulnerability labeled as critical has been found in kovidgoyal Kitty up to 0.48.1. This issue affects the function handle_remote_echo of the file kitty/window.py of the component DCS Handlers. Such manipulation leads to os command injection.
This vulnerability is listed as CVE-2026-72913. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
Red Hat
kitty: Kitty: Arbitrary Code Execution via Chained DCS Escape Sequences
vendor_redhat·2026-08-10·CVSS 7.3
CVE-2026-72913 [HIGH] CWE-78 kitty: Kitty: Arbitrary Code Execution via Chained DCS Escape Sequences
kitty: Kitty: Arbitrary Code Execution via Chained DCS Escape Sequences
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
A flaw was found in Kitty, a cross-platform GPU based terminal. This vulnerability allows an attacker to achieve arbitrary code execution by chaining specific escape sequences (`@kitty-echo` and `@kitty-ssh`) when a user displays untrusted
No detection rules found.
No public exploits indexed.
https://github.com/kovidgoyal/kitty/commit/9dca948e9bec3c926ab3370f2cd10f9b9b10821fhttps://github.com/kovidgoyal/kitty/releases/tag/v0.48.2https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94https://sw.kovidgoyal.net/kitty/changelog/#id1https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94
2026-08-10
Published