PT-2026-48968 · Kovid Goyal · Kitty

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-42851

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with cat, a log line, an email body rendered in less, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

Fix

Missing Authorization

Code Injection

Weakness Enumeration

CWE-862

CWE-94

Related Identifiers

CVE-2026-42851

Affected Products

Kitty

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-42851 · Security Note
• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332 · Note