Threats affecting pkg:github/kitty

CVE-2026-95835 is a medium severity vulnerability in kitty terminal emulator versions from 0.25.0 up to but not including 0.49.0. It involves missing authorization checks in the askpass escape code handler, allowing a local user to obtain text typed into a prompt displayed by another user's kitty terminal. This occurs because the handler opens and writes to a POSIX shared memory object without verifying ownership or permissions. An attacker can craft a prompt that tricks the victim into typing secrets, which the attacker can then read from the shared memory object. This vulnerability does not require elevated privileges on the victim's account.

CVE-2026-95834 is a use-after-free vulnerability in the drag and drop protocol implementation of the kitty terminal emulator versions 0.47.0 through before 0.49.0. It occurs because a pointer to freed heap memory is used after an error during drag and drop operations, leading to undefined behavior in the terminal process. The flaw arises from improper handling of error paths in drag_remote_file_data() and related functions, which free memory but allow continued use of dangling pointers.

A missing authorization vulnerability in kitty terminal emulator versions 0.47.0 up to but not including 0.49.0 allows a program writing to the terminal to access contents of files dragged over the window without user completion of the drop. The flaw arises because the drag and drop protocol handler serves drag data requests without verifying the drop state, enabling unauthorized file content disclosure.

CVE-2026-80431 is an out-of-bounds write vulnerability in the kitty terminal emulator affecting versions from 0.40.0 up to but not including 0.49.0. The flaw occurs in the text sizing protocol when processing certain grapheme clusters longer than four codepoints in OSC 66 escape codes, leading to writes beyond a fixed-size buffer. This can cause the kitty process to terminate, closing all its windows, tabs, and child processes. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.8.

CVE-2026-80430 is a medium severity vulnerability in kitty versions 0.47.0 up to but not including 0.49.0. It involves improper link resolution before file access in the drag and drop protocol, allowing a local user to create files and directories outside the intended staging directory by exploiting symlink handling. The vulnerability arises because the code resolves paths by string construction rather than component-wise traversal, ignoring certain error conditions and not validating symlink targets. This can lead to arbitrary file and directory creation at any path writable by the user running kitty.

CVE-2026-95832 is a critical vulnerability in the kitty terminal emulator affecting versions from 0.47.3 up to but not including 0.49.0. It involves improper neutralization of special elements in output used by a downstream component, allowing an attacker to execute arbitrary shell commands with the privileges of the user running the terminal. The flaw arises because unrecognized field names in color control escape code queries are echoed back without proper sanitization, enabling command injection. This vulnerability builds on a previous fix (CVE-2026-54057) but still allows sufficient characters to compose malicious commands. The exploit leverages the pseudoterminal master interface and can be triggered remotely via SSH data handling before credential checks. The CVSS 4.0 base score is 9.3, indicating critical severity.