CVE-2026-54055 Details
Description
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
A local privilege escalation vulnerability has been identified in Kitty, a cross-platform GPU-based terminal, in versions prior to 0.47.2. The issue arises in Kitty's file transmission protocol, where a child process in the terminal can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition between symlink validation and file creation. This allows the process to write to arbitrary files on the filesystem by bypassing the transfer confirmation prompt. The vulnerability exists because the file creation process does not use the O_NOFOLLOW flag, enabling an attacker to create a symlink that redirects the write operation to an unintended location. The affected component is the DestFile class in the file_transmission.py module.
Users can update to Kitty version 0.47.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh | CISA-ADP | MitigationVendor Advisory |
| https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-426 | Untrusted Search Path | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kovidgoyal kitty | < 0.47.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |