CVE-2026-42850 Overview
CVE-2026-42850 is a command injection vulnerability in kitty, a cross-platform GPU-based terminal emulator developed by kovidgoyal. The flaw affects all versions prior to 0.47.0. Attackers can craft a special escape code that causes kitty to return an error message containing attacker-controlled data. The error response is not escaped and is echoed back to the terminal with carriage return and line feed (CRLF) characters. The receiving shell interprets the echoed content as a command and executes it. Exploitation requires the victim to have a netcat or similar listening connection attached to the terminal. The issue is tracked as CWE-77: Improper Neutralization of Special Elements used in a Command and resolved in version 0.47.0.
Critical Impact
Successful exploitation results in arbitrary command execution in the victim's shell with the privileges of the local user.
Affected Products
- kovidgoyal kitty terminal emulator, all versions prior to 0.47.0
- Linux and macOS environments running vulnerable kitty builds
- Users running netcat or comparable listeners that pipe network input into the terminal
Discovery Timeline
- 2026-06-12 - CVE-2026-42850 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-42850
Vulnerability Analysis
The vulnerability lies in how kitty handles malformed or attacker-crafted escape sequences. When kitty encounters certain escape codes that trigger an error, the terminal emits an error message back through the terminal stream. This error message includes attacker-controllable text and is terminated with CRLF sequences. Because the shell receives the echoed output as standard input under specific listener configurations, the CRLF separates the injected content into discrete commands. The shell then executes the resulting strings as if the user had typed them.
Exploitation depends on a precondition: the victim must have piped network data into the terminal session, typically through netcat or a comparable tool acting as a listener or active connection. Without that ingress path, the escape sequence cannot reach kitty from a remote attacker.
Root Cause
The root cause is missing neutralization of control characters in kitty's error response path. Error strings returned by the terminal include raw bytes from the offending input and append CRLF, but the code does not strip or escape shell-significant sequences. This is a classic command injection pattern catalogued as CWE-77.
Attack Vector
The attacker sends crafted bytes across an established TCP connection that the victim has bridged to the terminal using netcat or a similar utility. The payload contains a kitty escape code designed to provoke an error. kitty parses the sequence, fails, and writes the error message back into the terminal stream. The CRLF in the response causes the shell to treat trailing bytes as a new command line and execute them. The result is command execution as the local user under the active shell.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-p64q-59hq-5q65 for vendor-supplied technical detail.
Detection Methods for CVE-2026-42850
Indicators of Compromise
- Shell history entries showing commands the user did not type, especially immediately after a netcat session
- Unexpected child processes spawned by interactive shells whose parent is a kitty window connected to nc, ncat, or socat
- Inbound TCP connections to user workstations followed by outbound connections, file writes, or credential access activity
Detection Strategies
- Hunt for kitty processes whose descendant tree includes nc, ncat, socat, or similar listeners combined with shell command execution
- Inspect terminal session logs for embedded escape sequences containing CRLF followed by shell metacharacters
- Correlate process creation telemetry with network connection events on endpoints running kitty versions below 0.47.0
Monitoring Recommendations
- Inventory installed kitty versions across Linux and macOS endpoints and flag any build earlier than 0.47.0
- Alert on interactive use of netcat family tools on developer or administrator workstations
- Capture parent-child process lineage for shells spawned under terminal emulators to support post-incident review
How to Mitigate CVE-2026-42850
Immediate Actions Required
- Upgrade kitty to version 0.47.0 or later on every affected endpoint
- Stop using netcat or similar utilities to bridge untrusted network traffic into an interactive terminal until the upgrade is complete
- Audit recent shell history on systems where users routinely pipe network data into kitty
Patch Information
The vendor fixed the issue in kitty version 0.47.0. Distribution-packaged builds should be updated through the operating system package manager. Source builds should be rebuilt from the tagged release. Refer to the GitHub Security Advisory GHSA-p64q-59hq-5q65 for vendor guidance.
Workarounds
- Pipe untrusted network output through a filter that strips escape sequences before it reaches the terminal, for example by routing through cat -v or strings
- Use a dedicated non-interactive shell or a logging wrapper when running netcat listeners, so injected commands do not reach an interactive shell
- Restrict who can run network listeners on workstations using sudo policies or AppArmor and SELinux profiles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
