CVE-2026-95835
MediumCVSS 5.6Summary
Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain text typed into a prompt displayed by kitty. The handle_remote_askpass() function opens the POSIX shared memory object named in the escape code and writes the user's answer back without verifying ownership or permissions. An attacker can create such an object, cause the victim's kitty to render a prompt of their choosing, and read the typed secret afterwards.
Risk Assessment
A local user on the same system can capture data typed by the victim into a kitty prompt, including passwords, without requiring any privilege on the victim's account. The prompt text is not sanitised, allowing the attacker to overwrite the warning line kitty prints above it.
Recommendation
Update kitty to version 0.49.0 or later. Until then, avoid running kitty on multi-user systems where the POSIX shared memory namespace is shared between users.
Other vulnerabilities in kitty
See all- CVE-2026-95834Medium
Use After Free vulnerability in the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory. The bug occurs in drag_remote_file_data() in kitty/dnd.c, where a pointer to an array is used after it has been freed by helper functions.
- CVE-2026-80432Medium
Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, and to continue reading files after the drag leaves the window.
- CVE-2026-80431Medium
In kitty versions from 0.40.0 to 0.49.0, there is an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. A program writing to the terminal can send an OSC 66 escape code with a grapheme cluster longer than four codepoints, causing a write past the end of the fixed-size buffer in screen_handle_multicell_command(). This results in termination of the kitty process and all its windows, tabs and child processes.
- CVE-2026-80430Medium
In kitty versions 0.47.0 to 0.49.0, there is an improper link resolution before file access in the drag source staging path of the drag and drop protocol. A program writing to the terminal can create files and directories outside the staging directory by crafting entries with symlinks and subsequently following them during item creation. This allows the attacker to write to any path writable by the user running kitty.
- CVE-2026-95832Critical
In kitty from version 0.47.3 before 0.49.0, the colour control escape code handler does not neutralize field names in replies, allowing a program writing to the terminal to execute an arbitrary command in the user's shell. An attacker can compose a shell command using printable ASCII characters and a newline from handle_remote_ssh().
- CVE-2026-33642Critical
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
- CVE-2026-72913High
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
- CVE-2026-33633High
Kitty terminal versions 0.46.2 and below have a heap buffer overflow in load_image_data(). Any process that can write to the terminal's stdin can send a crafted APC command with a PNG declaration exceeding twice the initial buffer capacity, causing an immediate crash and potentially remote code execution.
Original NVD description (English source)
Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the POSIX shared memory object named in the escape code, parses a prompt definition out of it, and writes the user's answer back into an object of that same name, without at any point checking that the object is owned by the user running kitty or that its permissions exclude other users. The equivalent consumer of the same SharedMemory class in the ssh kitten performs exactly that check; the askpass path did not. The handler is reached through a device control string processed from the byte stream of the window, so the attacker must also cause bytes of their choosing to be displayed by the victim's terminal. Where the POSIX shared memory namespace is shared between the two users, a second local user can create an object with permissions that allow the victim to read and write it, cause the victim's kitty to render a prompt of the attacker's choosing, including a masked password prompt, and read the typed secret back out of the object afterwards. The prompt text is additionally passed to the display without control character sanitisation, so it can overwrite the warning line kitty prints above it. The answer is written by reopening an object of that name when the user answers, rather than through the handle already held. This results in disclosure of a secret typed by the victim to a second local user, and does not require any privilege on the victim's account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS