TI-2026-63703 Aliases CVE-2026-95832 GHSA-hvwf-v5fx-xvj6

Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell

MEDIUM 41CWE-74Published 2026-09-25 · Updated 2026-09-25

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0016 5th percentileScored 2026-11-07

Fix Fixed kitty (Kovid Goyal): 0.49.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kovidgoyal	kitty	0.47.3 to before 0.49.0	0.49.0	Patch available	CNA

kitty Vendorkovidgoyal Affected 0.47.3 to before 0.49.0 Fixed in 0.49.0 Patch available CNA

Remediation

Fix · CNA kitty (Kovid Goyal) Fixed in 0.49.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-25
Kovid Goyal kitty 0.49.0
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2026-55508 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal processPriority LOW 29
- TI-2026-55509 Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a dropPriority LOW 26
- TI-2026-63706 Missing ownership check on the shared memory object named by the kitty askpass escape codePriority LOW 24
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products

External Secrets Operator for Red Hat OpenShift
Logging Subsystem for Red Hat OpenShift
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2026-95832
2026-10-03 Alias added: GHSA-hvwf-v5fx-xvj6

References

Patch 1

https://github.com/kovidgoyal/kitty/commit/03fbdad855490470233954bc810e517027e5e640

Advisory 1

https://secur0.com/en/cna/cve-list/cve-2026-95832-kitty-color-control-command-execution

Other 3

TI-2026-26023 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVSS 3.1CRITICAL 9.9
TI-2026-51129 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences CVSS 4.0HIGH 7.3
TI-2026-26014 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVSS 3.1HIGH 8.8
TI-2026-51386 Missing authorization in kovidgoyal calibre CVSS 3.1HIGH 7.5
TI-2026-51385 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE CVSS 4.0HIGH 8.5
TI-2026-38585 calibre: Arbitrary Code Execution in Template Formatter via Book Metadata CVSS 4.0HIGH 8.5

See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences