CVE-2020-35605
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to...
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
CVE-2020-35605- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
CVE-2020-35605- Updated
- 2026-11-02
EUVDEUVD-2020-23271 No score
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
EUVD-2020-23271- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6fm5-8wjh-r65x
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to...
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
GHSA-6fm5-8wjh-r65x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
CVE-2020-35605- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-35605
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
DEBIAN-CVE-2020-35605- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-35605
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
- Record
UBUNTU-CVE-2020-35605- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0025-1 No score
Security update for kitty
This update for kitty fixes the following issue:
- CVE-2020-35605: Fixed an RCE due to filenames containing special characters contained in error messages (boo#1180298).
- Record
openSUSE-SU-2021:0025-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10896-1 No score
kitty-0.21.2-1.2 on GA media
These are all security issues fixed in the kitty-0.21.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10896-1- Updated
- 2026-11-02
OSVUSN-5659-1 No score
kitty vulnerabilities
Stephane Chauveau discovered that kitty incorrectly handled image filenames with special characters in error messages. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-35605)
Carter Sande discovered that kitty incorrectly handled escape sequences in desktop notifications. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-41322)
- Record
USN-5659-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kittyDebian:12 |
before 0.19.3-1 | 0.19.3-1 |
kittyDebian:13 |
before 0.19.3-1 | 0.19.3-1 |
kittyDebian:14 |
before 0.19.3-1 | 0.19.3-1 |
kittyDebian:10 |
before 0.13.3-1+deb10u1, plus listed versions 0.13.3-1 |
0.13.3-1+deb10u1 |
kittyUbuntu:20.04:LTS |
before 0.15.0-1ubuntu0.2, plus listed versions 0.14.3-10.14.4-10.14.6-10.15.0-10.15.0-1build1 |
0.15.0-1ubuntu0.2 |
kittyUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 0.15.0-1ubuntu0.2, plus listed versions 0.14.3-10.14.4-10.14.6-10.15.0-10.15.0-1build1 |
0.15.0-1ubuntu0.2 |
kittyUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 0.21.2-1ubuntu0.22.04.1, plus listed versions 0.19.3-10.21.2-10.21.2-1build1 |
0.21.2-1ubuntu0.22.04.1 |
kittyopenSUSE:Leap 15.2 |
before 0.16.0-lp152.2.3.1 | 0.16.0-lp152.2.3.1 |
kittyopenSUSE:Tumbleweed |
before 0.21.2-1.2 | 0.21.2-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35605 is a critical vulnerability (CVSS 9.8) in Kovidgoyal Kitty, published December 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.76%, the 89th percentile. Fixed in kitty 0.19.3-1.
References
github.com/kovidgoyal/kitty/issues/3128
debian.org/security/2020/dsa-4819
nvd.nist.gov/vuln/detail/CVE-2020-35605
security-tracker.debian.org/tracker/CVE-2020-35605