Missing Authorization in Kitty’s Askpass Escape Code Handler Affects Shared Memory Security

CVE-2026-95835

What is CVE-2026-95835?

A security flaw in Kitty’s askpass escape code handler allows unauthorized local users to access sensitive information typed by the terminal user. In versions 0.25.0 through 0.48.0, the handler fails to verify the ownership of a POSIX shared memory object, enabling an attacker to manipulate prompts displayed in the victim's terminal. By exploiting this vulnerability, an attacker can prompt the victim for sensitive information, such as passwords, without any privileges on the victim's account, raising significant security concerns.

References