kovidgoyal kitty up to 0.47.1 os.open link following

Summaryinfo

A vulnerability labeled as critical has been found in kovidgoyal kitty up to 0.47.1. Impacted is the function os.open. The manipulation results in link following. This vulnerability is identified as CVE-2026-54055. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in kovidgoyal kitty up to 0.47.1. It has been classified as problematic. Affected is the function os.open. The manipulation with an unknown input leads to a link following vulnerability. CWE is classifying the issue as CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This is going to have an impact on integrity, and availability. CVE summarizes:

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-54055 since 06/11/2026. The exploitability is told to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 0.47.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36556). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• kovidgoyal

Name

• kitty

Version

• 0.47.0
• 0.47.1

Website

• Product: https://github.com/kovidgoyal/kitty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion