Threat Intelligence Database

Kitty terminal versions prior to 0.47.3 contain a code injection vulnerability via the OSC 21 color-control query reply. This vulnerability allows attacker-controlled bytes, including newlines, to be reflected into the shell's input without sanitization. The issue is fixed in version 0.47.3.

Kitty versions 0.47.0 and 0.47.1 contain a vulnerability in the `kitten dnd` remote drag-and-drop feature that allows a malicious remote source to overwrite or truncate arbitrary files writable by the local user. This occurs due to improper handling of symbolic links during file staging on case-sensitive filesystems, where an attacker can create a symlink and then cause a write operation to follow it, leading to file modification outside the intended directory. The issue is fixed in version 0.47.2.

Kitty terminal versions prior to 0.47.2 contain a local privilege escalation vulnerability due to a race condition in the file transmission protocol. A child process can exploit a time-of-check-time-of-use (TOCTOU) flaw where symlink validation is bypassed, allowing writes to arbitrary filesystem locations. This occurs because the file creation call does not use the O_NOFOLLOW flag, enabling symlink following after the initial check. The issue is fixed in version 0.47.2.

Kitty terminal versions prior to 0.47.0 contain a code injection vulnerability that allows an attacker to execute arbitrary Python code within the running kitty process. This can occur when a program writes bytes to the terminal, such as through a remote SSH session, viewing files, or rendering text in various interfaces. The vulnerability does not require user approval or interaction beyond displaying the malicious input. Version 0.47.0 addresses this issue.

Kitty terminal versions prior to 0.47.0 contain a command injection vulnerability. An attacker can exploit a specially crafted escape code that triggers an unescaped error message echoed back to the terminal, which the shell then executes. Exploitation requires the victim to use netcat or a similar tool to connect to the attacker or listen for incoming connections. Version 0.47.0 addresses this issue.