CVE-2026-72913 in Kitty
Summary
by MITRE • 08/11/2026
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical command injection flaw in the Kitty terminal emulator that affects versions prior to 0482. This security weakness stems from improper handling of Data Control Sequences (DCS) within the terminal's window management system, specifically through the kitty-echo and kitty-ssh handlers implemented in kitty/window.py. The core technical issue occurs when these handlers process unauthenticated data directly into the child shell's standard input stream without proper sanitization or validation mechanisms. The kitty-echo handler accepts printable shell command characters through handle_remote_echo, while the kitty-ssh handler utilizes get_ssh_data from kittens/ssh/utils.py which emits newlines to facilitate command execution. When these two handlers are chained together, they create a pathway for arbitrary command execution where attacker-controlled data can be interpreted and executed by the underlying shell.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass full remote code execution capabilities within the user's terminal environment. This flaw leverages the trust relationship between the terminal emulator and its child processes, allowing malicious actors to inject commands that execute with the privileges of the affected user. The vulnerability is particularly dangerous because it can be triggered through the display of untrusted terminal data, making it exploitable in scenarios such as viewing malicious terminal output from network services, processing untrusted files, or encountering crafted escape sequences in terminal sessions. This type of vulnerability falls under CWE-78, which specifically addresses improper neutralization of special elements used in OS commands, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter to execute malicious commands. The attack vector relies on the user's interaction with untrusted terminal content, making it particularly challenging to defend against through traditional network security measures.
The fix implemented in version 0.48.2 addresses this vulnerability by introducing proper authentication checks and input sanitization mechanisms within the DCS handlers. This mitigation ensures that data received through the kitty-echo and kitty-ssh sequences undergoes rigorous validation before being written to the child shell's stdin. The solution incorporates principle of least privilege enforcement, where only authenticated and properly validated data can influence shell operations, effectively breaking the command injection chain. Additionally, the updated implementation likely includes proper escaping of special characters and implements stricter parsing logic for DCS sequences to prevent unintended command interpretation. Security practitioners should note that this vulnerability demonstrates the importance of validating all user-supplied input in terminal applications and highlights the risks associated with direct data forwarding to shell processes without adequate security controls. The remediation approach addresses both the immediate threat vector and establishes better defensive practices for future terminal emulator development, emphasizing the need for comprehensive input validation in terminal I/O handling components.