Is CVE-2026-54056 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54056 being exploited in the wild.

How severe is CVE-2026-54056?

High severity, with a CVSS score of 7.6, published 12 June 2026.

Which products and versions are affected?

kovidgoyal kitty 0.47.0, 0.47.1.

Is there a fix for CVE-2026-54056?

A patch was published on 2026-06-12: Version 0.47.2 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54056 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54056?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54056: Kitty terminal arbitrary file overwrite in kitten dnd remote staging

CVE-2026-54056 · Severity: high · CVSS 7.6 · Published 2026-06-12

Kitty, a popular cross-platform terminal emulator, contains a vulnerability in its drag-and-drop feature when used over remote connections like SSH. A malicious source could trick the terminal into overwriting or clearing files on the user's local computer that the user has permission to modify. This could lead to data loss or the corruption of important configuration files if a user drags content from a malicious remote source into their terminal.

Quick answers

Is CVE-2026-54056 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54056 being exploited in the wild.
How severe is CVE-2026-54056?: High severity, with a CVSS score of 7.6, published 12 June 2026.
Which products and versions are affected?: kovidgoyal kitty 0.47.0, 0.47.1.
Is there a fix for CVE-2026-54056?: A patch was published on 2026-06-12: Version 0.47.2 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54056 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54056?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the `kitten dnd` component of Kitty (specifically `kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`) due to improper link resolution. On case-sensitive filesystems, the remote drag-and-drop staging process fails to de-duplicate remote basenames. An attacker can provide a `text/uri-list` containing a symlink followed by a regular file with the same name. Because `utils.CreateAt()` uses `openat()` with `O_CREAT|O_TRUNC` but lacks `O_NOFOLLOW`, the terminal follows the previously created symlink and writes the file content to the symlink's target outside the staging directory. This occurs before the final user confirmation prompt, rendering the `--confirm-drop-overwrite` protection ineffective. The issue is fixed in version 0.47.2.

Affected products

kovidgoyal kitty 0.47.0, 0.47.1

Timeline

2026-06-08: advisory: Vendor advisory published on GitHub
2026-06-12: disclosed: CVE published to NVD
2026-06-12: patched: Version 0.47.2 released to address the issue

References

https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.