CVE-2026-42850

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

This update for kitty fixes the following issues:

Changes in kitty:

• Update to 0.48.2:

  • Wayland: Fix regression in previous release that broke drag and drop on Plasma (#10284)
  • diff kitten: Fix a rare crash when showing a large diff due to incorrect locking when highlighting
  • Allow the private DCS kitty-echo escape code to only echo numbers
  • Linux: Fix an approx 1MB memory leak when reloading the config, introduced in version 0.40.0 (#10290)
  • Desktop file chooser integration: when the specified directory does not exist, open file chooser at home directory (#10292)
  • Add support for terminal visibility reports
    • https://rockorager.dev/misc/visibility-reports/
  • tab_title_template: Add a field that evaluates to the total memory used by all child processes in the tab (#10293)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.tab_title_template

• Update to 0.48.1:

  • Wayland: fix a regression in the previous release that broke window sizing for on Hyprland/Sway with fractional scales and an initial specified size (#10268)
  • Wayland: fix a regression in 0.47.3 that broke dragging on the Niri compositor (#10271)
  • Wayland: get initial window size in cells working in most cases on Hyprland/Sway with fractional scaling by using the fractional scale of the primary monitor
  • Wayland: fix using remote control to resize OS windows on some tiling compositors leading to broken rendering
  • macOS: fix edge=none panel height shrinking when margin_top is non-zero in the panel/quick-access-terminal kittens (#10278)

• Update to 0.48.0:

  • Implement vertical tabs by setting tab_bar_edge to left or right (#9855)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.tab_bar_edge
  • Graphics protocol: Add a new transient usage hint that clients can send to terminals to indicate an image is meant for only short duration use (#10092)
    • https://sw.kovidgoyal.net/kitty/graphics-protocol/#image-usage-hints
  • On first press in an unfocused OS Window/kitty window give it focus and pass the mouse event through to the clicked element. This is a behavior change but aligns with platform defaults on macOS. Linux has no platform defaults here as far as I can tell, so it gets to follow along. (#10233)
  • kitten @ get-text: Add support for alternate and alternate_scrollback extents to fetch text from the alternate screen buffer (#10165)
  • Wayland: Fix first OS window being a few cells too small when initial_window_width/initial_window_height are set in cells and a fractional display scale is in use (#10146)
  • macOS: New option macos_ns_window_layer to more precisely control what layer panel OS windows are placed on (#10116)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.macos_ns_window_layer
  • macOS: New option macos_use_physical_screen_frame to allow panel OS Windows to cover the macOS global dock bar (#10116)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.macos_use_physical_screen_frame
  • kitty binary builds are now built on Ubuntu 22 upgraded from Ubuntu 18 for improved performance from better compilers
  • macOS: Fix incorrect horizontal alignment when using text sizing protocol (#10179)
  • edit-in-kitty: Return exit code from underlying editor process on exit (#10198)
  • Make erasing last command robust against commands with no output and commands in the scrollback (#10201)
  • Fix superfluous margin visible to the left and right of the tab bar when background_opacity is less than one and the window width is not a multiple of the cell width (#10212)
    • https://sw.kovidgoyal.net/kitty/conf/#opt-kitty.background_opacity
  • hints kitten: Add a new flag kitty +kitten hints --prefix-free to generate hints without a shared prefix (#10210)
    • https://sw.kovidgoyal.net/kitty/kittens/hints/#cmdoption-kitty-kitten-hints-prefix-free
  • Wayland GNOME: Fix…

It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-42850)

It was discovered that kitty incorrectly handled remote edit requests in terminal output. An attacker could possibly use this issue to execute arbitrary code with the user's privileges. (CVE-2026-42851)

Thai Son Dinh and Nguyen Huy Vu Dung discovered that kitty incorrectly handled destination paths in its file transmission protocol. A local attacker could possibly use this issue to overwrite arbitrary files with the user's privileges. (CVE-2026-54055)

It was discovered that kitty incorrectly sanitized responses to color queries. An attacker could possibly use this issue to execute arbitrary commands with the user's privileges. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54057)