Read the docs
TI-2026-38989 Aliases CVE-2026-54055

Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol

Priority MEDIUM 56CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00072 0th percentileScored 2026-11-07
Fix Fixed kitty (kovidgoyal): 0.47.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kovidgoyalkittybefore 0.47.20.47.2Patch availableCNA
  • kitty Vendorkovidgoyal Affected before 0.47.2 Fixed in 0.47.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*before 0.47.2Vulnerablekovidgoyal
  • cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:* Versions before 0.47.2 Vulnerable ·kovidgoyal

Remediation

  • Fix · CNA kitty (kovidgoyal) Fixed in 0.47.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54055

References

Advisory 1

  • TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
  • TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
  • TI-2026-38991 Kitty vulnerable to command injection via unsanitized OSC 21 query reply CVSS 4.0HIGH 7.3
  • TI-2025-28495 Origin validation error in kitty CVSS 3.1HIGH 7.8
  • TI-2026-38990 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging CVSS 3.1HIGH 7.6
  • TI-2020-18102 The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote… CVSS 3.1CRITICAL 9.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences