CVE-2026-42851: Kovidgoyal Kitty RCE Vulnerability

CVE-2026-42851 Overview

CVE-2026-42851 is a code injection vulnerability [CWE-94] in the Kitty cross-platform GPU-based terminal emulator. Versions prior to 0.47.0 allow any process that writes bytes to the terminal to execute attacker-controlled Python inside the running Kitty process. The execution occurs with the user's full privileges. Triggering the flaw requires no approval prompt, no remote-control permission, no shell-integration handshake, no clipboard interaction, and no editor involvement. Trigger sources include remote SSH peers, downloaded files viewed with cat, log lines, email bodies rendered in less, and TUI-rendered issue content. Maintainer Kovidgoyal addressed the issue in Kitty version 0.47.0.

Critical Impact
Any byte stream rendered in a vulnerable Kitty terminal can execute arbitrary Python code in the terminal process with the user's privileges, enabling local code execution from passive content viewing.

Affected Products

Kovidgoyal Kitty versions prior to 0.47.0
All platforms supported by Kitty (Linux, macOS)
Workflows that render untrusted output in Kitty, including SSH sessions, cat, less, and TUI applications

Discovery Timeline

2026-06-12 - CVE-2026-42851 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2026-42851

Vulnerability Analysis

The vulnerability is an arbitrary code execution flaw classified as Improper Control of Generation of Code [CWE-94]. Kitty parses control sequences written to its pseudo-terminal as part of normal rendering. Prior to version 0.47.0, one or more of these sequences allowed an unauthenticated byte producer to inject Python code that Kitty's embedded interpreter executed in-process. The execution path bypassed every existing gate, including the remote-control permission model, the shell-integration trust boundary, the clipboard prompt, and the editor-launch path. Exploitation does not require user interaction beyond viewing the malicious bytes inside the terminal. Because Kitty itself runs as the logged-in user, the injected Python inherits the full session privileges, including filesystem access, environment variables, SSH keys, and the ability to spawn child processes.

Root Cause

The root cause is unsafe handling of terminal escape sequences that reach Python evaluation without an explicit authorization step. The control sequence dispatcher routes attacker-controlled data to a code execution sink instead of confining it to display-only side effects. No allowlist, approval prompt, or origin check separates trusted local input from untrusted remote bytes.

Attack Vector

The attack vector is local, but the byte source can originate remotely. An attacker who controls any data that eventually reaches the terminal stdout can deliver the payload. Representative delivery channels include an SSH server printing crafted output during a session, a log file tailed by an administrator, a less-rendered email body, a TUI issue tracker showing a remote comment, or a downloaded text file inspected with cat. The user only needs to render the content; no keystroke or click is required after rendering begins.

No verified proof-of-concept code is published in the NVD record. The vendor's security advisory describes the affected control flow. See the Kitty GHSA-w98g-hpvr-r332 advisory for technical details.

Detection Methods for CVE-2026-42851

Indicators of Compromise

Kitty process spawning unexpected child processes such as sh, bash, python, or network utilities shortly after rendering remote content
Outbound network connections initiated by the kitty process to non-update destinations
Unexpected writes to ~/.ssh/, ~/.config/, or shell profile files coincident with terminal sessions
Presence of Kitty binaries reporting a version string below 0.47.0 in production inventories

Detection Strategies

Inventory installed Kitty versions across endpoints and flag any release earlier than 0.47.0
Hunt for process trees where kitty is the parent of interpreters or shells launched without an interactive command line
Correlate SSH session start times with anomalous child process creation under the Kitty process
Review EDR telemetry for file or credential access by kitty outside its normal configuration paths

Monitoring Recommendations

Alert on kitty process making outbound connections that are not to the update endpoint
Monitor for new persistence artifacts created during terminal sessions, including cron entries, systemd user units, and shell rc modifications
Capture command-line audit logs for any python or shell invocation whose parent process is kitty

How to Mitigate CVE-2026-42851

Immediate Actions Required

Upgrade Kitty to version 0.47.0 or later on every workstation, jump host, and developer endpoint
Until patched, avoid using cat, less, or tail to view untrusted files, remote logs, or email bodies inside Kitty
Restrict SSH sessions from untrusted hosts on workstations running vulnerable Kitty builds
Audit recent Kitty sessions on multi-user or shared systems for signs of injected Python execution

Patch Information

Kovidgoyal released Kitty 0.47.0 to remediate the vulnerability. The fix is documented in the GitHub Security Advisory GHSA-w98g-hpvr-r332. Operators should install the upstream release or the equivalent distribution package once their package maintainer ships the backport.

Workarounds

Pipe untrusted content through a sanitizer that strips control sequences before display, for example cat file | tr -d '\033'
Use a different, unaffected terminal emulator for sessions that render attacker-influenced bytes until the patch is deployed
Disable Kitty features that broaden the parser's surface area, such as remote control, when not required

bash

# Verify the installed Kitty version meets the fixed release
kitty --version

# Example upgrade on a system using the upstream installer
curl -L https://sw.kovidgoyal.net/kitty/installer.sh | sh /dev/stdin

# Defensive viewing pattern for untrusted text while patching is pending
cat untrusted.log | tr -d '\033' | less -R