kovidgoyal kitty vulnerabilities

Newest CVEs

• CVE-2026-72913

  Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

  kovidgoyal · kitty

  High7.3
• CVE-2026-54057

  Kitty vulnerable to command injection via unsanitized OSC 21 query reply

  kovidgoyal · kitty

  High7.3
• CVE-2026-54056

  Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging

  kovidgoyal · kitty

  High7.6
• CVE-2026-54055

  Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol

  kovidgoyal · kitty

  Medium5.0
• CVE-2026-42851

  @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

  kovidgoyal · kitty

  High7.8
• CVE-2026-42850

  Kitty has a shell command injection

  kovidgoyal · kitty

  High7.4
• CVE-2026-33642

  Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check

  kovidgoyal · kitty

  Critical9.9
• CVE-2026-33633

  Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler

  kovidgoyal · kitty

  High7.5