Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3… (CVE-2026-95832)

CVE-2026-95832 describes an improper neutralization vulnerability in kitty terminal's colour control escape code handler affecting versions from 0.14.3-1 up to 0.48.2-1.1ubuntu1. The function color_control() in kitty/window.py responds to queries for unrecognized field names by including them in replies without proper sanitization. The reply is then written to the pseudoterminal master by write_escape_code_to_child() in kitty/screen.c, where it is indistinguishable from user input and not neutralized for shell interpretation. Although the payload is restricted to printable ASCII and delimiters are consumed, sufficient characters remain to compose shell commands. Additionally, a newline character can be injected via handle_remote_ssh(), enabling execution of attacker-chosen commands with the privileges of the user running the terminal.

Successful exploitation allows an attacker to execute arbitrary commands in the context of the user's shell running the kitty terminal. This can lead to unauthorized actions and compromise of the user's environment with the same privileges as the terminal user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted programs that write to the terminal or interacting with untrusted SSH sessions through kitty. Monitor vendor communications for updates and apply patches promptly once released.