Executive brief
Kitty, a popular high-performance terminal emulator, contains a vulnerability that allows malicious code to run automatically when a user views certain text. If a user displays a specially crafted file or connects to a malicious server using 'cat', 'less', or SSH, an attacker can execute commands on the user's computer with their full permissions. This could lead to total system compromise, data theft, or the installation of malware without any warning or approval prompts.
Technical details
A vulnerability exists in kitty's handling of the private Device Control String (DCS) sequence '@kitty-edit|'. An attacker can bypass existing security mitigations by using the '--color' option within this sequence to trigger the 'geninclude' configuration directive. Because 'geninclude' uses 'runpy.run_path()' to process .py files, an attacker who can write bytes to the terminal (via SSH, log files, or 'cat') can force the kitty process to execute arbitrary Python code in-process. The attack requires no special permissions, remote-control settings, or user interaction beyond the victim viewing the malicious output. The issue is fixed in version 0.47.0.
Affected products
- kovidgoyal kitty < 0.47.0
Timeline
- 2026-05-19: advisory: GitHub advisory GHSA-w98g-hpvr-r332 published
- 2026-06-12: disclosed: CVE-2026-42851 published to NVD
- 2026-06-12: patched: Version 0.47.0 released to address the vulnerability