Command Injection Vulnerability in Kitty Terminal by Kovid Goyal
CVE-2026-72913

7.3HIGH

Key Information:

Vendor

Kovidgoyal

Status
Kitty
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72913?

Kitty Terminal is susceptible to a command injection vulnerability that allows attackers to execute arbitrary commands through unauthenticated data sent to the child shell's stdin. Prior to version 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers could be exploited when untrusted terminal data was displayed. This vulnerability is addressed in version 0.48.2, emphasizing the need for users to update their installations to mitigate the risk of unauthorized command execution.

Affected Version(s)

kitty < 0.48.2

References

https://github.com/kovidgoyal/kitty/security/advisories/G...
x_refsource_CONFIRM
https://github.com/kovidgoyal/kitty/commit/9dca948e9bec3c...
x_refsource_MISC
https://github.com/kovidgoyal/kitty/releases/tag/v0.48.2
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.