CVE-2026-42850

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.47.0

Description Command injection is possible within the subshell through the terminal error mechanism. A specific escape code triggers an error that is not properly escaped and is echoed back to the terminal with Carriage Return Line Feed (CRLF) characters, causing the shell to execute the injected command. This can be exploited if a user connects to an attacker-controlled server using netcat or a similar program, or listens for an incoming connection.

Recommendations Update to version 0.47.0.