CVE-2026-54056

Name of the Vulnerable Software and Affected Versions Kitty versions 0.47.0 through 0.47.1

Description In the kitten dnd component, a malicious remote drag-and-drop source can overwrite or truncate arbitrary files that the local user has permission to write. This occurs because remote text/uri-list drops are staged in a temporary directory where duplicate remote basenames are not de-duplicated on case-sensitive filesystems. An attacker can create a staged symlink and subsequently send a regular-file entry with the same name. The write operation utilizes the utils.CreateAt() function and openat(O RDWR|O CREAT|O TRUNC) without the O NOFOLLOW flag, causing the system to follow the symlink and write data outside the staging directory before the final overwrite confirmation occurs. This issue specifically affects the remote drag-and-drop staging in kittens/dnd/drop.go and tools/utils/file at fd.go.

Recommendations Update to version 0.47.2.