Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-42851@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
High 7.8
In plain English
A high-severity code injection in kitty from kovidgoyal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kitty | no fix listed | DEBIAN-CVE-2026-42851 |
| Debian:13 | kitty | 0.41.1-2+deb13u2 | DEBIAN-CVE-2026-42851 |
| Debian:14 | kitty | 0.47.0-1 | DEBIAN-CVE-2026-42851 |
| Ubuntu:25.10 | kitty | no fix listed | UBUNTU-CVE-2026-42851 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kovidgoyal | kitty | < 0.47.0 |
Weakness: CWE-94, CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332 x_refsource_CONFIRM