Command Injection Vulnerability in Kitty Terminal Software by Kovid Goyal

CVE-2026-95832

What is CVE-2026-95832?

The Kitty Terminal software contains a command injection vulnerability that arises from improper handling of certain output elements. Specifically, versions prior to 0.49.0 can be exploited through the color control escape code handler. When an unrecognized field name is queried, the software inadvertently places this field name in the reply sent to the terminal. This response is then passed to a pseudoterminal master without necessary neutralization, allowing attackers to inject and execute arbitrary commands in the user's shell. Due to inadequate filtering of printable ASCII characters, an attacker can craft a malicious command that gets executed with the permissions of the terminal user. This vulnerability highlights critical implications for terminal security, necessitating updates to affected versions.

References