SB2026092263 - Debian update for kitty
Published: September 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Command injection (CVE-ID: CVE-2026-42850)
CWE-ID: CWE-77 - Command injection
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements used in a command in kitty's error handling for the kitty ssh function when processing a specially crafted kitty escape code received over a connection. A remote attacker can send a specially crafted escape code that injects shell commands to execute arbitrary shell commands.
User interaction is required to establish or accept a connection with the attacker.
2) Code Injection (CVE-ID: CVE-2026-42851)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of generation of code in the @kitty-edit DCS handler and color configuration parser when processing attacker-controlled terminal output. A remote attacker can send terminal control sequences containing a --color=geninclude directive to execute arbitrary code.
User interaction is required to view attacker-controlled bytes through a kitty terminal; no further approval, editor interaction, or remote-control permission is required.
3) Link following (CVE-ID: CVE-2026-54055)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write to arbitrary user-writable files.
The vulnerability exists due to improper link resolution before file access in the DestFile.write_data() method of kitty/file_transmission.py when processing file transmission data after validating a destination path. A local user can create a symlink after the initial validation and send file transmission data to write through the symlink.
User interaction is required to confirm the file transfer.
4) Improper Neutralization of Escape, Meta, or Control Sequences (CVE-ID: CVE-2026-54057)
CWE-ID: CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to improper neutralization of escape, meta, or control sequences in OSC 21 color-control query reply handling when processing a crafted OSC 21 query reply. A remote attacker can provide a query containing newline characters to execute arbitrary commands.
User interaction is required to process crafted terminal content.
Remediation
Install update from vendor's website.