CVEFinder.io

CVE-2026-54056

⚠️ high
🔍 Scan for this CVE
Summary

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt

Description

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.

CVSS Score
7.6
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-06-12
First Seen: 2026-06-13
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.3% of all 329,456 vulnerabilities in our database.

#101,202
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 15, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-06-16
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
CWE IDs (Weakness Types)
CWE-59

📦 Affected Products 1

Vendor Product Status Affected Versions
kovidgoyal kitty Affected
> 0.47.0 < 0.47.2

🔗 References 1

https://github.com/kovidgoyal/kitty/security/advisor...
Exploit Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42850 ⚠️ high 8.8 0.2 Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the ... 2026-06-12
CVE-2026-42851 ⚠️ high 7.8 0.1 Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty term... 2026-06-12
CVE-2026-54055 🔶 medium 5.0 0.1 Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability ex... 2026-06-12
CVE-2026-54057 ⚠️ high 7.8 0.1 Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply re... 2026-06-12
CVE-2026-33633 ⚠️ high 7.5 0.0 Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_dat... 2026-05-19
CVE-2026-33642 ⛔ critical 9.9 0.1 Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kit... 2026-05-19
These CVEs affect the same products