Executive brief
Kitty is a high-performance, GPU-based terminal emulator. A vulnerability in how the terminal handles specific error messages allows an attacker to remotely execute commands on a user's computer if the user connects to a malicious server or service (such as via netcat). This could lead to a full system compromise, allowing the attacker to view files or modify data on the victim's machine.
Technical details
A command injection vulnerability exists in Kitty versions prior to 0.47.0 due to improper neutralization of special elements in terminal escape codes. Specifically, using the '\x1bP@kitty-ssh|...' escape sequence can trigger a 'kitty-ssh' function that attempts to open a file via shm_open. When the operation fails, the resulting error message is returned to the terminal without proper escaping and includes CRLF characters. This causes the terminal to echo the error string back into the active shell buffer, where it is executed as a command. Exploitation requires the victim to connect to an attacker-controlled network service (e.g., via netcat) that sends the malicious escape sequence. The issue is resolved in version 0.47.0.
Affected products
- kovidgoyal kitty < 0.47.0
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD