Every CVE Search/ Get API key

CVE-2026-72913

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

7.3 HighFix available

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.21%Up 0.1 points since Aug 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.3

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Record
CVE-2026-72913
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-77, CWE-93, CWE-150
Updated
2026-11-02
EUVDEUVD-2026-55835 7.3

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Record
EUVD-2026-55835
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 7.3

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Record
CVE-2026-72913
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-77, CWE-93, CWE-150
Updated
2026-11-02
OSV 7.3

Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Record
CVE-2026-72913
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-150, CWE-77, CWE-93
Updated
2026-11-02
OSVDEBIAN-CVE-2026-72913 7.3

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Record
DEBIAN-CVE-2026-72913
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-72913 7.3

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Record
UBUNTU-CVE-2026-72913
CVSS 4.0
7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kitty
Debian:12
 All versions, plus listed versions
0.26.5-50.30.1-10.31.0-10.31.0-20.31.0-3
Show 35 moreShow less
0.31.0-40.32.0-10.32.1-10.32.2-10.33.0-20.33.1-10.34.1-10.35.1-10.35.2-10.36.1-10.36.4-10.36.4-20.36.4-30.37.0-10.38.1-10.39.0-10.39.1-10.40.0-10.41.1-10.41.1-20.42.1-10.42.2-10.43.1-10.44.0-10.45.0-10.45.0-20.46.1-10.46.2-10.47.0-10.47.0-20.47.0-30.47.3-10.47.4-10.48.2-10.48.2-1.1
 None known
kitty
Debian:13
 All versions, plus listed versions
0.41.1-20.41.1-2+deb13u10.41.1-2+deb13u20.42.1-10.42.2-1
Show 13 moreShow less
0.43.1-10.44.0-10.45.0-10.45.0-20.46.1-10.46.2-10.47.0-10.47.0-20.47.0-30.47.3-10.47.4-10.48.2-10.48.2-1.1
 None known
kitty
Debian:14
 before 0.48.2-1, plus listed versions
0.41.1-20.42.1-10.42.2-10.43.1-10.44.0-1
Show 9 moreShow less
0.45.0-10.45.0-20.46.1-10.46.2-10.47.0-10.47.0-20.47.0-30.47.3-10.47.4-1
0.48.2-1
kitty
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
0.14.3-10.14.4-10.14.6-10.15.0-10.15.0-1build10.15.0-1ubuntu0.20.15.0-1ubuntu0.2+esm1
 None known
kitty
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
0.19.3-10.21.2-10.21.2-1build10.21.2-1ubuntu0.22.04.10.21.2-1ubuntu0.22.04.1+esm1
 None known
kitty
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
0.26.5-3ubuntu20.26.5-5ubuntu10.31.0-30.31.0-40.32.2-1
Show 8 moreShow less
0.32.2-1build20.32.2-1build30.32.2-1ubuntu0.10.32.2-1ubuntu0.20.32.2-1ubuntu0.30.32.2-1ubuntu0.40.32.2-1ubuntu0.4+esm10.32.2-1ubuntu0.4+esm2
 None known
kitty
Ubuntu:26.10
 All versions, plus listed versions
0.45.0-1build10.47.0-30.47.4-10.48.2-1.1ubuntu1
 None known
kitty
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
0.41.1-20.43.1-10.44.0-10.45.0-10.45.0-1build10.45.0-1ubuntu0.1~esm10.45.0-1ubuntu0.1~esm2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-72913 is a high vulnerability (CVSS 7.3) in Kitty Project Kitty, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in kitty 0.48.2-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open