PT-2022-25815 · Kitty+4 · Kitty+4

Carter Sande · Published 2022-09-05 · Updated 2025-06-01 · CVE-2022-41322

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.26.2

Description The issue is related to insufficient validation in the desktop notification escape sequence, which can lead to arbitrary code execution. This occurs when a user displays attacker-controlled content in the terminal and then clicks on a notification popup.

Recommendations For Kitty versions prior to 0.26.2, update to version 0.26.2 or later to resolve the issue. As a temporary workaround, consider avoiding the display of attacker-controlled content in the terminal and refraining from clicking on notification popups from untrusted sources.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

ALT-PU-2022-2565

ALT-PU-2022-2571

CVE-2022-41322

DLA-4203-1

MGASA-2022-0364

USN-5659-1

Affected Products

Alt Linux

Debian

Kitty

Linuxmint

Ubuntu

References · 28

• 🔥 https://bugs.gentoo.org/868543 · Exploit
• https://github.com/kovidgoyal/kitty/compare/v0.26.1...v0.26.2 · Patch
• https://github.com/kovidgoyal/kitty/commit/f05783e64d5fa62e1aed603e8d69aced5e49824f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41322 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-41322 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47RK7MBSVY5BWDUTYMJUFPBAYFSWMTOI · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5659-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/47RK7MBSVY5BWDUTYMJUFPBAYFSWMTOI · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4203-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41322 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41322 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41322 · Security Note
• https://osv.dev/vulnerability/USN-5659-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202209-22 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35605 · Vendor Advisory