Read the docs
TI-2026-55507 Aliases CVE-2026-80430GHSA-phg7-mgrc-j9pj

Link following in kovidgoyal kitty

Priority LOW 20CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdir_data_for_drag() in kitty/dnd.c resolves a descendant of the staged item tree by constructing a path string and opening it with safe_open(path, O_DIRECTORY | O_RDONLY, 0) rather than by walking the tree one component at a time, so a client that declares two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causes mkdirat() to fail with EEXIST, which the code ignores, and causes the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory, which is then passed as the dirfd argument to add_payload() and used for every further create operation on that item and its descendants. Entry names are sanitised against path separators and dot components, but symlink targets are not validated. Files are created with O_CREAT | O_WRONLY | O_EXCL at mode 0644, so existing files cannot be overwritten, and directories are created with mkdirat() at mode 0755, so the attacker can create intermediate directories that did not previously exist. This results in the creation of files and directories at any path writable by the user running kitty, provided the symlink target is an existing directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed kitty (Kovid Goyal): 0.49.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kovidgoyalkitty0.47.0 to before 0.49.00.49.0Patch availableCNA
  • kitty Vendorkovidgoyal Affected 0.47.0 to before 0.49.0 Fixed in 0.49.0 Patch available CNA

Remediation

  • Fix · CNA kitty (Kovid Goyal) Fixed in 0.49.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Kovid Goyal kitty 0.49.0

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-63703 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shellPriority MEDIUM 41
    • TI-2026-55508 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal processPriority LOW 29
    • TI-2026-55509 Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a dropPriority LOW 26
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-80430
  2. 2026-10-03 Alias added: GHSA-phg7-mgrc-j9pj

References

Patch 1

Advisory 1

Other 2

  • TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
  • TI-2026-51129 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences CVSS 4.0HIGH 7.3
  • TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
  • TI-2026-51386 Missing authorization in kovidgoyal calibre CVSS 3.1HIGH 7.5
  • TI-2026-51385 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE CVSS 4.0HIGH 8.5
  • TI-2026-38585 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata CVSS 4.0HIGH 8.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences