CVE-2026-72913

Summary

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Affected Software

VendorProductVersion RangeStatus
kovidgoyalkitty< 0.48.2affected

Weaknesses

  • CWE-77: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-93: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
  • CWE-150: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

References