SB2026092259 - Multiple vulnerabilities in kitty

Description

This security bulletin contains information about 2 vulnerabilities.

1) Link following (CVE-ID: CVE-2026-54056)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to overwrite or truncate arbitrary files writable by the local kitty user.

The vulnerability exists due to improper link resolution before file access in the kitten dnd remote drag-and-drop staging code when processing remote text/uri-list drops with duplicate basenames. A remote user can create a staged symlink and then send a same-name regular-file entry to overwrite or truncate arbitrary files writable by the local kitty user.

User interaction is required to perform the remote drag-and-drop action.

2) Link following (CVE-ID: CVE-2026-54055)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write to arbitrary user-writable files.

The vulnerability exists due to improper link resolution before file access in the DestFile.write_data() method of kitty/file_transmission.py when processing file transmission data after validating a destination path. A local user can create a symlink after the initial validation and send file transmission data to write through the symlink.

User interaction is required to confirm the file transfer.

Remediation

Install update from vendor's website.

References

• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x
• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh