CVE-2026-95832

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.3 through 0.48.x

Description An issue in the colour control escape code handler allows a program writing to the terminal to execute arbitrary commands in the user's shell. This occurs because the color control() function in kitty/window.py includes unrecognized field names in its reply, which the write escape code to child() function in kitty/screen.c then writes to the pseudoterminal master. Since the output is not neutralized for the shell, it is indistinguishable from user input. While payloads are reduced to printable ASCII and certain delimiters are consumed, enough characters survive to compose a shell command. Additionally, the handle remote ssh() function in kitty/window.py provides a newline via get ssh data() in kittens/ssh/utils.py before credentials are checked, facilitating the execution of attacker-chosen commands with the privileges of the user running the terminal.

Recommendations Update kitty to version 0.49.0.