Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kovidgoyal | kitty | 0.47.0 to before 0.49.0 | 0.49.0 | Patch available | CNA |
- kitty Vendorkovidgoyal Affected 0.47.0 to before 0.49.0 Fixed in 0.49.0 Patch available CNA
Remediation
- Fix · CNA kitty (Kovid Goyal) Fixed in 0.49.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Kovid Goyal kitty 0.49.0
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-63703 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shellPriority MEDIUM 41
- TI-2026-55508 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal processPriority LOW 29
- TI-2026-63706 Missing ownership check on the shared memory object named by the kitty askpass escape codePriority LOW 24
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-80432
- 2026-10-03 Alias added: GHSA-ghc4-9m25-367h
References
More kovidgoyal vulnerabilities
- TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
- TI-2026-51129 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences CVSS 4.0HIGH 7.3
- TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
- TI-2026-51386 Missing authorization in kovidgoyal calibre CVSS 3.1HIGH 7.5
- TI-2026-51385 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE CVSS 4.0HIGH 8.5
- TI-2026-38585 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata CVSS 4.0HIGH 8.5
Sources
- CVE-2026-80432 · CVE Program
- CVE-2026-80432 · NVD
- FIRST EPSS
- GHSA-ghc4-9m25-367h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-80432 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences