TI-2026-31059 Aliases CVE-2026-42851

@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

LOW 35CWE-862Published 2026-06-12 · Updated 2026-06-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862 and CWE-94.

Summary

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00164 5th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed kitty (kovidgoyal): 0.47.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kovidgoyal	kitty	before 0.47.0	0.47.0	Patch available	CNA

kitty Vendorkovidgoyal Affected before 0.47.0 Fixed in 0.47.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kovidgoyal:kitty::::::::	before 0.47.0	Vulnerable	kovidgoyal

cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:* Versions before 0.47.0 Vulnerable ·kovidgoyal

Remediation

Fix · CNA kitty (kovidgoyal) Fixed in 0.47.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-42851

References

Exploit 1

https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332

TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
TI-2026-38991 Kitty vulnerable to command injection via unsanitized OSC 21 query reply CVSS 4.0HIGH 7.3
TI-2025-28495 Origin validation error in kitty CVSS 3.1HIGH 7.8
TI-2026-38990 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging CVSS 3.1HIGH 7.6
TI-2026-38989 Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol CVSS 3.1MEDIUM 5.0

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences