CVE-2026-42851Disclosure(kovidgoyal / kitty)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

kovidgoyal CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332

Weakness type (CWE)

CWE-94CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kitty

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

kovidgoyal

Products

kitty

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets2 URLs

By indicator

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-42851 Remote Code Execution in Kitty Terminal Versions Prior to 0.47.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42851 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post discloses CVE‑2026‑42851 as a Remote Code Execution flaw in Kitty Terminal (versions < 0.47.0), providing links to details and alerts, but offers no PoC, exploit code, active exploitation evidence, patch, or debunking.
0000041
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	kovidgoyal	kitty	-	-	-

Explore more

Back to dashboard kovidgoyal CVEs kitty vulnerabilities