CVE-2026-80432

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.0 through 0.48.x

Description An authorization flaw exists in the drag and drop protocol handling. A program writing to the terminal can obtain the contents of files dragged over the window even if the user does not complete the drop action. This occurs because the drop enqueue request() function in kitty/dnd.c serves drag data requests without verifying the drop state of the window, allowing a client to receive data while a drag is merely hovering. Additionally, the drop left child() function fails to clear the pending request state, open file descriptors, directory handles, and URI lists when a drag leaves the window. Consequently, a client can continue reading through a retained directory handle or maintain an active file transfer stream after the drag has ended. The kitty process reads the file contents directly from the filesystem using paths provided by the drag source, leading to unauthorized disclosure of file contents.

Recommendations Update to version 0.49.0.