CVE-2026-42851

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.47.0

Description A flaw allows a program capable of writing bytes to the terminal—such as a remote SSH peer, a downloaded file viewed with cat, a log line, an email body rendered in less, or an issue body in a TUI—to execute attacker-supplied Python code within the running process. This execution occurs with the user's full privileges and does not require an approval prompt, remote-control permissions, shell-integration interaction, clipboard access, or editor interaction.

Recommendations Update to version 0.47.0.