CVE-2026-54057

⚠️ high

Summary

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

CVSS Score

7.8

High

EPSS Score

0.1

Exploit Probability

Published Date

2026-06-12

First Seen: 2026-06-13

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.6% of all 329,456 vulnerabilities in our database.

#100,230

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jun 15, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-06-16

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS Vector 4.0

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE IDs (Weakness Types)

CWE-94 CWE-150

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
kovidgoyal	kitty	Affected	< 0.47.3

🔗 References 1

https://github.com/kovidgoyal/kitty/security/advisor...

Exploit Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42850	⚠️ high	8.8	0.2	Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the ...	2026-06-12
CVE-2026-42851	⚠️ high	7.8	0.1	Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty term...	2026-06-12
CVE-2026-54055	🔶 medium	5.0	0.1	Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability ex...	2026-06-12
CVE-2026-54056	⚠️ high	7.6	0.2	Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote d...	2026-06-12
CVE-2026-33633	⚠️ high	7.5	0.0	Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_dat...	2026-05-19
CVE-2026-33642	⛔ critical	9.9	0.1	Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kit...	2026-05-19

These CVEs affect the same products