TI-2026-38991 CVE-2026-54057
Kitty vulnerable to command injection via unsanitized OSC 21 query reply
Priority HIGH 67
Kitty is a cross-platform GPU based terminal.
Vulnerabilities
9 records
TI-2026-38990 CVE-2026-54056
Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
Priority HIGH 66
Kitty is a cross-platform GPU based terminal.
TI-2026-38989 CVE-2026-54055
Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
Priority MEDIUM 56
Kitty is a cross-platform GPU based terminal.
TI-2026-31059 CVE-2026-42851
@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
Priority LOW 35
Kitty is a cross-platform GPU based terminal.
TI-2026-31058 CVE-2026-42850
Kitty has a shell command injection
Priority LOW 34
Kitty is a cross-platform GPU based terminal.
TI-2026-26023 CVE-2026-33642
Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
Priority HIGH 82
Kitty is a cross-platform GPU based terminal.
Priority HIGH 73
Kitty is a cross-platform GPU based terminal.
TI-2025-28495 CVE-2025-43929 · GHSA-cch3-2vm3-v73j
Origin validation error in kitty
Priority HIGH 67
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).
TI-2020-18102 CVE-2020-35605 · GHSA-6fm5-8wjh-r65x
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote…
Priority MEDIUM 49
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.