CVE-2026-42851 Details
Description
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
A remote code execution vulnerability has been identified in Kitty, a cross-platform GPU-based terminal, in versions prior to 0.47.0. The issue arises from the handling of the private DCS '@kitty-edit|' sequence, which is dispatched without authentication or origin checks. This vulnerability allows a program that can write bytes to the Kitty terminal, such as a remote SSH peer or a file viewed with 'cat', to execute attacker-supplied Python code within the Kitty process, using the user's full privileges. The vulnerability does not require any approval prompt, remote-control permissions, shell integration, clipboard access, or editor interaction. The exploitation takes advantage of the 'geninclude' configuration directive, which is parsed as inline Kitty config and can execute Python code via the 'runpy.run_path()' function.
Users can upgrade to Kitty version 0.47.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kovidgoyal kitty | < 0.47.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |