Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Kitty through 0.48.1 can execute commands when crafted terminal data is displayed. Upgrade to 0.48.2, avoid printing raw untrusted logs/files, and use viewers that escape control sequences. https://nvd.nist.gov/vuln/detail/CVE-2026-72913
Post summary
The advisory highlights that Kitty up to version 0.48.1 is vulnerable to command execution via crafted terminal data and advises users to upgrade to 0.48.2 and sanitize untrusted logs.