Kovid Goyal

Improper link resolution in the drag source staging path of the drag and drop protocol allows a program writing to the terminal to create files and directories outside the staging directory. This occurs because the `subdir data for drag()` function in `kitty/dnd.c` resolves descendants of the staged item tree by constructing a path string and opening it with `safe open(path, O DIRECTORY | O RDONLY, 0)` instead of walking the tree component by component. An attacker can declare two entries with the same name—first a symlink targeting an arbitrary absolute path and second a directory—causing `mkdirat()` to fail with EEXIST. The code ignores this failure, leading the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory. This descriptor is then passed as the `dirfd` argument to `add payload()` and used for all subsequent create operations. While entry names are sanitized, symlink targets are not validated. Files are created with O CREAT | O WRONLY | O EXCL at mode 0644, preventing the overwriting of existing files, but directories are created with `mkdirat()` at mode 0755, allowing the creation of new intermediate directories at any path writable by the user running the application, provided the symlink target is an existing directory.

An issue in the colour control escape code handler allows a program writing to the terminal to execute arbitrary commands in the user's shell. This occurs because the `color control()` function in `kitty/window.py` includes unrecognized field names in its reply, which the `write escape code to child()` function in `kitty/screen.c` then writes to the pseudoterminal master. Since the output is not neutralized for the shell, it is indistinguishable from user input. While payloads are reduced to printable ASCII and certain delimiters are consumed, enough characters survive to compose a shell command. Additionally, the `handle remote ssh()` function in `kitty/window.py` provides a newline via `get ssh data()` in `kittens/ssh/utils.py` before credentials are checked, facilitating the execution of attacker-chosen commands with the privileges of the user running the terminal.

An out-of-bounds write exists in the natural width branch of the text sizing protocol. The `screen handle multicell command()` function in `kitty/screen.c` appends each codepoint of a grapheme cluster using `lc.chars[lc.count++] = ch` without performing a capacity check. Because `lc` is declared as a four-element `char type` array via the `RAII ListOfChars` macro, an OSC 66 escape code containing a grapheme cluster longer than four codepoints writes beyond the buffer. If the cluster is preceded by a sequence causing an intermediate flush, the buffer is migrated to the heap by `ensure space for chars()`, and the write occurs past the heap allocation. This leads to the termination of the kitty process, including all associated windows, tabs, and child processes.

An authorization flaw exists in the drag and drop protocol handling. A program writing to the terminal can obtain the contents of files dragged over the window even if the user does not complete the drop action. This occurs because the `drop enqueue request()` function in `kitty/dnd.c` serves drag data requests without verifying the drop state of the window, allowing a client to receive data while a drag is merely hovering. Additionally, the `drop left child()` function fails to clear the pending request state, open file descriptors, directory handles, and URI lists when a drag leaves the window. Consequently, a client can continue reading through a retained directory handle or maintain an active file transfer stream after the drag has ended. The kitty process reads the file contents directly from the filesystem using paths provided by the drag source, leading to unauthorized disclosure of file contents.

A Use After Free issue exists in the drag source path of the drag and drop protocol. A program writing to the terminal can cause the terminal to read from and write to freed heap memory. This occurs because the `drag remote file data()` function in `kitty/dnd.c` maintains a `DragRemoteItem` pointer to an array it does not own. When `toplevel data for drag()` or `subdir data for drag()` are called, they may trigger the `abrt()` macro via `add payload()` or `populate dir entries()`. The `abrt()` macro executes `cancel drag()`, which calls `drag free offer()` to free the array. Since the helper functions return void, the caller is unaware of the teardown and proceeds to call `all children complete()` using the freed pointer, leading to undefined behavior in the terminal process. This is reachable via the byte stream of any program running in the window.

Missing authorization in the askpass escape code handler allows a local user to obtain text typed into a prompt displayed by the terminal. The `handle remote askpass()` function in `kitty/window.py` opens a POSIX shared memory object named in the escape code, parses a prompt definition, and writes the user's answer back into an object of the same name without verifying ownership or permissions. An attacker can create a shared memory object, trigger the victim's terminal to render a custom prompt (such as a masked password prompt) via a device control string, and subsequently read the typed secret. Additionally, the prompt text is passed to the display without control character sanitisation, allowing it to overwrite the warning line printed by the software.