Missing Authorization in Drag and Drop Protocol for Kitty Terminal by Kovid Goyal

CVE-2026-80432

What is CVE-2026-80432?

A vulnerability exists in the drag and drop protocol of Kitty Terminal versions prior to 0.49.0. It allows unauthorized access to file contents by permitting a client to retrieve data from files dragged over the window, even if the drag action is not completed. The issue arises from improper checks on the drop state of the window, which means that when the mouse is hovering over the terminal, data can be read by the Kitty process without any user action. This could lead to the unintentional disclosure of sensitive information from files during drag operations.

References