Executive brief
Kitty is a high-performance, GPU-based terminal emulator. A vulnerability in how the terminal handles specific color-control queries allows a malicious file or website to inject commands directly into the user's shell. If a user views a specially crafted file (for example, using the 'cat' command), the terminal may automatically execute arbitrary commands on the user's computer, potentially leading to full system compromise or data loss.
Technical details
Kitty terminal versions prior to 0.47.3 are vulnerable to a command injection flaw similar to historic xterm vulnerabilities. The root cause is located in the OSC 21 (color-control) handler, where the terminal reflects unknown query keys back into the reply without proper sanitization. Because the terminal's VT parser does not treat newlines as terminators for these sequences, an attacker can embed newline characters within a query. When the terminal sends the reply back to the child process (the shell), these newlines cause the shell to interpret the subsequent attacker-controlled bytes as new, independent commands. Exploitation occurs when a user displays malicious escape sequences, such as by 'cat-ing' a crafted text file. This has been patched in version 0.47.3.
Affected products
- kovidgoyal kitty < 0.47.3
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched: Fixed in version 0.47.3