Kitty Project vulnerabilities

Products

• Kitty 15

Newest

• kitty project kitty Missing ownership check on the shared memory object named by the kitty askpass escape code CVE-2026-95835 5.6 MediumSeptember 25, 2026
• kitty project kitty Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer CVE-2026-95834 4.6 MediumSeptember 25, 2026
• kitty project kitty Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop CVE-2026-80432 6.0 MediumSeptember 25, 2026
• kitty project kitty Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process CVE-2026-80431 6.8 MediumSeptember 25, 2026
• kitty project kitty Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory CVE-2026-80430 4.6 MediumSeptember 25, 2026
• kitty project kitty Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell CVE-2026-95832 9.3 CriticalSeptember 25, 2026
• kitty project kitty Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences CVE-2026-72913 Fix available 7.3 HighAugust 10, 2026
• kitty project kitty Kitty vulnerable to command injection via unsanitized OSC 21 query reply CVE-2026-54057 Fix available 7.3 HighJune 12, 2026
• kitty project kitty Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging CVE-2026-54056 Fix available 7.6 HighJune 12, 2026
• kitty project kitty Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol CVE-2026-54055 Fix available 5.0 MediumJune 12, 2026
• kitty project kitty @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE CVE-2026-42851 Fix available 7.8 HighJune 12, 2026
• kitty project kitty Kitty has a shell command injection CVE-2026-42850 Fix available 7.4 HighJune 12, 2026
• kitty project kitty Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check CVE-2026-33642 Fix available 9.9 CriticalMay 19, 2026
• kitty project kitty Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler CVE-2026-33633 Fix available 7.5 HighMay 19, 2026
• kitty project kitty open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local... CVE-2025-43929 Public exploitFix available 4.1 MediumApril 20, 2025