Kovid Goyal Kitty vulnerabilities

CVE-2026-54057 [HIGH] CWE-94 CVE-2026-54057: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-con Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

CVE-2026-80432 [MEDIUM] CWE-862 CVE-2026-80432: Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 b Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking

CVE-2026-80431 [MEDIUM] CWE-787 CVE-2026-80431: Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 bef Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capac

CVE-2026-80430 [MEDIUM] CWE-59 CVE-2026-80430: Improper Link Resolution Before File Access in the drag source staging path of the drag and drop pro Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by con

CVE-2026-95835 [MEDIUM] CWE-862 CVE-2026-95835: Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the POSIX shared memory object named in the escape code, parses a prompt de

CVE-2026-95834 [MEDIUM] CWE-416 CVE-2026-95834: Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.4 Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag()