Kovid Goyal

**Name of the Vulnerable Software and Affected Versions** kitty versions 0.47.0 through 0.48.x **Description** Improper link resolution in the drag source staging path of the drag and drop protocol allows a program writing to the terminal to create files and directories outside the staging directory. This occurs because the `subdir data for drag()` function in `kitty/dnd.c` resolves descendants of the staged item tree by constructing a path string and opening it with `safe open(path, O DIRECTORY | O RDONLY, 0)` instead of walking the tree component by component. An attacker can declare two entries with the same name—first a symlink targeting an arbitrary absolute path and second a directory—causing `mkdirat()` to fail with EEXIST. The code ignores this failure, leading the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory. This descriptor is then passed as the `dirfd` argument to `add payload()` and used for all subsequent create operations. While entry names are sanitized, symlink targets are not validated. Files are created with O CREAT | O WRONLY | O EXCL at mode 0644, preventing the overwriting of existing files, but directories are created with `mkdirat()` at mode 0755, allowing the creation of new intermediate directories at any path writable by the user running the application, provided the symlink target is an existing directory. **Recommendations** Update kitty to version 0.49.0 or later.

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write escape code to child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle remote ssh() in kitty/window.py, which writes the bytes yielded by get ssh data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal.

**Name of the Vulnerable Software and Affected Versions** kitty versions 0.40.0 through 0.48.x **Description** An out-of-bounds write exists in the natural width branch of the text sizing protocol. The `screen handle multicell command()` function in `kitty/screen.c` appends each codepoint of a grapheme cluster using `lc.chars[lc.count++] = ch` without performing a capacity check. Because `lc` is declared as a four-element `char type` array via the `RAII ListOfChars` macro, an OSC 66 escape code containing a grapheme cluster longer than four codepoints writes beyond the buffer. If the cluster is preceded by a sequence causing an intermediate flush, the buffer is migrated to the heap by `ensure space for chars()`, and the write occurs past the heap allocation. This leads to the termination of the kitty process, including all associated windows, tabs, and child processes. **Recommendations** Update to version 0.49.0 or later.

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop enqueue request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop left child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag remote file data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel data for drag() or subdir data for drag(), and then continues to use that pointer. Those helpers, and add payload() and populate dir entries() which they call, report errors through the abrt() macro, which expands to cancel drag() followed by a plain return, and cancel drag() calls drag free offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all children complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O CREAT with O EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir data for drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag free offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window.

**Name of the Vulnerable Software and Affected Versions** kitty versions 0.25.0 through 0.48.9 **Description** Missing authorization in the askpass escape code handler allows a local user to obtain text typed into a prompt displayed by the terminal. The `handle remote askpass()` function in `kitty/window.py` opens a POSIX shared memory object named in the escape code, parses a prompt definition, and writes the user's answer back into an object of the same name without verifying ownership or permissions. An attacker can create a shared memory object, trigger the victim's terminal to render a custom prompt (such as a masked password prompt) via a device control string, and subsequently read the typed secret. Additionally, the prompt text is passed to the display without control character sanitisation, allowing it to overwrite the warning line printed by the software. **Recommendations** Update kitty to version 0.49.0 or later.