CVE-2026-72913

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.48.2

Description In the kitty/window.py file, the @kitty-echo and @kitty-ssh DCS handlers write unauthenticated data to the child shell's stdin. The handle remote echo() function accepts printable shell command characters, and the handle remote ssh() function calls get ssh data() in kittens/ssh/utils.py, which emits a newline. By chaining these handlers, an attacker can execute arbitrary commands when a user displays untrusted terminal data.

Recommendations Update to version 0.48.2.