CVE-2026-42851: kovidgoyal kitty Code Injection

Vulnerability summary

CVE-2026-42851 is a high (CVSS 7.8) Code Injection vulnerability in kovidgoyal kitty. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-06-2026
   PublishedVulnerability first disclosed.
2. 16-06-2026
   Last modifiedVulnerability information updated.

Description

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.