CVE-2026-54055

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.47.2

Description A local privilege escalation exists in the file transmission protocol. A child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition—a scenario where a system checks a condition (like a file's status) and then uses the result, but the condition changes between the check and the use. Specifically, the os.open() function used to create files does not use the O NOFOLLOW flag, which prevents the system from following symbolic links. This allows an attacker to create a symlink between the initial status check and the actual file opening, directing the write operation to an arbitrary destination.

Recommendations Update to version 0.47.2.