kitty EUVD-2026-87226

Requires kitty 0.47.0 through 0.48.x with the drag-and-drop protocol, a window that has registered to accept drops, and a client able to write escape sequences to that terminal (a local program or a process in an active session such as SSH). The decisive precondition is user interaction: the victim must drag a file or directory over the kitty window (a hover/move event) - the flaw lets the client request and receive that offered data before, or without, the user ever completing the drop, and drop_left_child() leaves directory handles and in-flight file transfers readable even after the drag leaves. Limiting factors: local attack vector, mandatory drag interaction by the victim, and disclosure is bounded to the files the drag source actually offered (not arbitrary attacker-chosen paths).

This is a genuine but moderate-severity information-disclosure flaw, not a high-urgency issue. The vendor-assigned CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC/VI/VA:N but SC:H) is internally consistent with the description: the terminal process itself is unharmed (no vulnerable-system impact) but user files handled during a drag session are disclosed to a subsequent system, hence SC:H and the 6.0 score. Two signals temper real-world urgency: (1) exploitation is local (AV:L) - the attacker must already be able to write escape sequences to the terminal (a local program, or a process reachable through an active session such as SSH), and (2) it requires user interaction (UI:P) - the victim must physically drag a file or directory over the kitty window. There is no EPSS score, no CISA KEV listing, and no public exploit code identified - so this is 'no public exploit identified at time of analysis,' with only a vendor/researcher advisory (Secur0) and a confirmed upstream patch. No conflicting signals were found between the CVSS vector and the description; both agree on local, low-privilege, interaction-dependent, confidentiality-only impact. Overall: a real defect worth patching on developer workstations but not a mass-exploitation priority.

A user runs a malicious or compromised program inside kitty (for example a CLI tool, or output streamed over an SSH session) that emits drag-and-drop protocol escape sequences. When the user drags a sensitive file or folder over the kitty window while deciding whether to drop it, the program issues a drag-data request; because drop_enqueue_request() never checks the window's drop state, kitty reads the offered file paths from disk and streams their contents back to the program even though the user never released the drop. No public exploit code has been identified, only a researcher advisory.