Read the docs
TI-2026-31058 Aliases CVE-2026-42850

Kitty has a shell command injection

Priority LOW 34CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kitty (kovidgoyal): 0.47.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kovidgoyalkittybefore 0.47.00.47.0Patch availableCNA
  • kitty Vendorkovidgoyal Affected before 0.47.0 Fixed in 0.47.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*before 0.47.0Vulnerablekovidgoyal
  • cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:* Versions before 0.47.0 Vulnerable ·kovidgoyal

Remediation

  • Fix · CNA kitty (kovidgoyal) Fixed in 0.47.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42850

References

Exploit 1

  • TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
  • TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
  • TI-2026-38991 Kitty vulnerable to command injection via unsanitized OSC 21 query reply CVSS 4.0HIGH 7.3
  • TI-2025-28495 Origin validation error in kitty CVSS 3.1HIGH 7.8
  • TI-2026-38990 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging CVSS 3.1HIGH 7.6
  • TI-2026-38989 Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol CVSS 3.1MEDIUM 5.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences