Kovid Goyal Kitty up to 0.48.x Drag/Drop Protocol kitty/dnd.c drop_enqueue_request/drop_left_child authorization

Summaryinfo

A vulnerability was found in Kovid Goyal Kitty up to 0.48.x. It has been rated as problematic. The affected element is the function drop_enqueue_request/drop_left_child of the file kitty/dnd.c of the component Drag/Drop Protocol. Performing a manipulation results in authorization. This vulnerability is identified as CVE-2026-80432. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Kovid Goyal Kitty up to 0.48.x. It has been classified as problematic. This affects the function drop_enqueue_request/drop_left_child of the file kitty/dnd.c of the component Drag/Drop Protocol. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-80432 since 08/26/2026. The exploitability is told to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 0.49.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Kovid Goyal

Name

• Kitty

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion