PT-2025-17401 · Kitty+1 · Kitty+1

0Xbencantcode · Published 2025-03-20 · Updated 2025-05-23 · CVE-2025-43929

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kitty versions prior to 0.41.0

Description The issue concerns the open actions.py script in kitty, which does not request user confirmation before executing a local executable file. This file may have been linked from an untrusted document, such as one opened in KDE ghostwriter.

Recommendations For versions prior to 0.41.0, update to version 0.41.0 or later to resolve the issue. As a temporary workaround, consider disabling the execution of local executable files linked from untrusted documents until a patch is applied. Restrict access to the open actions.py script to minimize the risk of exploitation.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BDU:2025-12846

CVE-2025-43929

Affected Products

Debian

Kitty

References · 22

• 🔥 https://github.com/0xBenCantCode/CVE-2025-43929 · Exploit
• 🔥 https://hitman.services/cve-2025-43929 · Exploit
• https://github.com/kovidgoyal/kitty/compare/v0.40.1...v0.41.0 · Patch
• https://github.com/kovidgoyal/kitty/commit/ce5cfdd9caf44c538af800a07162e1f49bd53c35 · Patch
• https://osv.dev/vulnerability/CVE-2025-43929 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-43929 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43929 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-43929 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-43929 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-43929 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12846 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-43929 · Vendor Advisory
• https://github.com/kovidgoyal/kitty/commit/ce5cfdd9caf44c538af800a7162e1f49bd53c35 · Note
• https://t.me/cvenotify/119080 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1913909360910086558 · Twitter Post