CVE-2026-54055: CWE-59: Improper Link Resolution Before File Access ('Link Following') in kovidgoyal kitty
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
AI Analysis
Technical Summary
CVE-2026-54055 describes a local privilege escalation vulnerability in the kitty terminal's file transmission protocol. The vulnerability arises from a Time-of-Check-Time-of-Use (TOCTOU) race condition where a child process can exploit the gap between symlink validation and file creation. Specifically, the os.open() system call used to create files does not use the O_NOFOLLOW flag, allowing an attacker to create a symbolic link after the initial validation but before file creation. This causes the file write operation to follow the symlink to an arbitrary file, enabling unauthorized file writes. The issue affects kitty versions prior to 0.47.2 and is resolved in version 0.47.2.
Potential Impact
An attacker with local access and limited privileges can exploit this vulnerability to write to arbitrary files on the filesystem, potentially escalating their privileges. The vulnerability does not impact confidentiality but can cause integrity violations and limited availability impact. The CVSS 3.1 base score is 5.0 (medium severity), reflecting the requirement for local access, high attack complexity, and user interaction.
Mitigation Recommendations
A fix is available in kitty version 0.47.2. Users should upgrade to version 0.47.2 or later to remediate this vulnerability. No other mitigations are indicated by the vendor advisory or source data.
CVE-2026-54055: CWE-59: Improper Link Resolution Before File Access ('Link Following') in kovidgoyal kitty
Description
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
CVSS v3.1
Score 5.0medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54055 describes a local privilege escalation vulnerability in the kitty terminal's file transmission protocol. The vulnerability arises from a Time-of-Check-Time-of-Use (TOCTOU) race condition where a child process can exploit the gap between symlink validation and file creation. Specifically, the os.open() system call used to create files does not use the O_NOFOLLOW flag, allowing an attacker to create a symbolic link after the initial validation but before file creation. This causes the file write operation to follow the symlink to an arbitrary file, enabling unauthorized file writes. The issue affects kitty versions prior to 0.47.2 and is resolved in version 0.47.2.
Potential Impact
An attacker with local access and limited privileges can exploit this vulnerability to write to arbitrary files on the filesystem, potentially escalating their privileges. The vulnerability does not impact confidentiality but can cause integrity violations and limited availability impact. The CVSS 3.1 base score is 5.0 (medium severity), reflecting the requirement for local access, high attack complexity, and user interaction.
Mitigation Recommendations
A fix is available in kitty version 0.47.2. Users should upgrade to version 0.47.2 or later to remediate this vulnerability. No other mitigations are indicated by the vendor advisory or source data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T18:24:35.096Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2c6778e617e2d834bac521
Added to database: 06/12/2026, 20:09:28 UTC
Last enriched: 06/19/2026, 22:19:09 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.