Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the… (CVE-2026-80432)

CVE-2026-80432 is a vulnerability in kitty terminal emulator versions from 0.47.0 before 0.49.0 where the drop handling path in the drag and drop protocol lacks proper authorization checks. Specifically, drop_enqueue_request() in kitty/dnd.c serves drag data requests without confirming if a drop has completed, allowing a client to receive data merely by hovering a drag over the window. Additionally, drop_left_child() improperly retains state and file descriptors after a drag leaves the window without dropping, enabling continued reading of file contents. The kitty process reads file contents from the filesystem using paths offered by the drag source, resulting in unauthorized disclosure of file contents without user consent.

An attacker with the ability to write to the terminal can obtain contents of files dragged over the kitty window without the user completing the drop action. This leads to unauthorized disclosure of local file contents. The vulnerability does not require privilege escalation or user interaction beyond dragging files over the window, but it does require the attacker to write to the terminal process. The impact is limited to information disclosure of files accessible by the user running kitty.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official kitty releases for a fix addressing this drag and drop authorization issue. Until a patch is available, avoid dragging files over kitty windows from untrusted sources or untrusted programs that can write to the terminal.