kovidgoyal kitty up to 0.47.1 kittens/dnd/drop.go utils.CreateAt link following

Summaryinfo

A vulnerability was found in kovidgoyal kitty up to 0.47.1. It has been classified as critical. Affected by this issue is the function utils.CreateAt of the file kittens/dnd/drop.go. Performing a manipulation results in link following. This vulnerability is reported as CVE-2026-54056. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in kovidgoyal kitty up to 0.47.1. This affects the function utils.CreateAt of the file kittens/dnd/drop.go. The manipulation with an unknown input leads to a link following vulnerability. CWE is classifying the issue as CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This is going to have an impact on integrity, and availability. The summary by CVE is:

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54056 since 06/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.47.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• kovidgoyal

Name

• kitty

Version

• 0.47.0
• 0.47.1

Website

• Product: https://github.com/kovidgoyal/kitty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion