CVE-2026-42851

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Kitty es un terminal multiplataforma basado en GPU. En versiones anteriores a la 0.47.0, un programa capaz de escribir bytes en un terminal kitty - un par SSH remoto, un archivo descargado visto con ’cat’, una línea de registro, un cuerpo de correo electrónico renderizado en ’less’, un cuerpo de incidencia en una TUI, etc. - puede hacer que kitty ejecute Python suministrado por el atacante dentro del proceso kitty en ejecución, con los privilegios completos del usuario. No hay solicitud de aprobación, ningún requisito de permiso de control remoto, ninguna interacción de integración de shell, ningún acceso al portapapeles y ninguna interacción con el editor. La versión 0.47.0 corrige el problema.

Information

Published : 2026-06-12 20:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-42851

Mitre link : CVE-2026-42851

CVE.ORG link : CVE-2026-42851

JSON object : View

Products Affected

kovidgoyal

kitty

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-862

Missing Authorization

{"id": "CVE-2026-42851", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42851", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-16T03:56:02.774347Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"status": "affected", "version": "< 0.47.0"}]}]}], "published": "2026-06-12T20:16:45.420", "references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal \u2014 a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. \u2014 can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue."}, {"lang": "es", "value": "Kitty es un terminal multiplataforma basado en GPU. En versiones anteriores a la 0.47.0, un programa capaz de escribir bytes en un terminal kitty - un par SSH remoto, un archivo descargado visto con \u2019cat\u2019, una l\u00ednea de registro, un cuerpo de correo electr\u00f3nico renderizado en \u2019less\u2019, un cuerpo de incidencia en una TUI, etc. - puede hacer que kitty ejecute Python suministrado por el atacante dentro del proceso kitty en ejecuci\u00f3n, con los privilegios completos del usuario. No hay solicitud de aprobaci\u00f3n, ning\u00fan requisito de permiso de control remoto, ninguna interacci\u00f3n de integraci\u00f3n de shell, ning\u00fan acceso al portapapeles y ninguna interacci\u00f3n con el editor. La versi\u00f3n 0.47.0 corrige el problema."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5F5CC5E-DE6C-4B63-BE58-D083F148C37B", "versionEndExcluding": "0.47.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}