Kitty vulnerable to command injection via unsanitized OSC 21 query reply
CVE-2026-54057

7.3HIGH

Key Information:

Vendor

Kovidgoyal

Status
Kitty
Vendor
CVE Published:
12 June 2026

What is CVE-2026-54057?

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

Affected Version(s)

kitty < 0.47.3

References

https://github.com/kovidgoyal/kitty/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.