@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
CVE-2026-42851

7.8HIGH

Key Information:

Vendor

Kovidgoyal

Status
Kitty
Vendor
CVE Published:
12 June 2026

What is CVE-2026-42851?

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with cat, a log line, an email body rendered in less, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

Affected Version(s)

kitty < 0.47.0

References

https://github.com/kovidgoyal/kitty/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.