Improper Neutralization of Escape, Meta, or Control Sequences in kitty - CVE-2026-54057

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU151617

Improper Neutralization of Escape, Meta, or Control Sequences in kitty - CVE-2026-54057

Published: September 22, 2026


Vulnerability identifier: #VU151617
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54057
CWE-ID: CWE-150
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to improper neutralization of escape, meta, or control sequences in OSC 21 color-control query reply handling when processing a crafted OSC 21 query reply. A remote attacker can provide a query containing newline characters to execute arbitrary commands.

User interaction is required to process crafted terminal content.


Affected software

kitty
Debian Linux
Ubuntu
kitty (Ubuntu package)
kitty (Debian package)

How to mitigate CVE-2026-54057

Install security update from vendor's website.

kitty - update to 0.47.3
kitty (Ubuntu package) - update to 0.45.0-1ubuntu0.1~esm2
kitty (Debian package) - update to 0.41.1-2+deb13u2

External References

Related Security Bulletins