Skip to content
Kovidgoyal Kitty vulnerabilities
-
kitty project kitty
Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences
CVE-2026-72913
Fix available
7.3 High
-
kitty project kitty
Kitty vulnerable to command injection via unsanitized OSC 21 query reply
CVE-2026-54057
Fix available
7.3 High
-
kitty project kitty
Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
CVE-2026-54056
Fix available
7.6 High
-
kitty project kitty
Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
CVE-2026-54055
Fix available
5.0 Medium
-
kitty project kitty
@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
CVE-2026-42851
Fix available
7.8 High
-
kitty project kitty
Kitty has a shell command injection
CVE-2026-42850
Fix available
7.4 High
-
kitty project kitty
Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
CVE-2026-33642
Fix available
9.9 Critical
-
kitty project kitty
Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
CVE-2026-33633
Fix available
7.5 High
-
kitty project kitty
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local...
CVE-2025-43929
Public exploitFix available
4.1 Medium
-
kovidgoyal kitty, debian linux +1 more
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to...
CVE-2020-35605
Fix available
9.8 Critical