CVE-2026-54056 Overview
CVE-2026-54056 is a symlink-following vulnerability in Kitty, a cross-platform GPU-based terminal emulator. The flaw resides in the kitten dnd remote drag-and-drop staging logic in versions 0.47.0 and 0.47.1. A malicious remote drag-and-drop source can overwrite or truncate arbitrary files writable by the local Kitty user. The issue is classified as a link following vulnerability [CWE-59].
Critical Impact
A remote attacker can exploit duplicate basename handling on case-sensitive filesystems to plant a symlink and then write through it, modifying files outside the staging directory.
Affected Products
- Kovidgoyal Kitty version 0.47.0
- Kovidgoyal Kitty version 0.47.1
- Vulnerable components: kittens/dnd/drop.go and tools/utils/file_at_fd.go
Discovery Timeline
- 2026-06-12 - CVE-2026-54056 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-54056
Vulnerability Analysis
The vulnerability affects how kitten dnd stages remote text/uri-list drops in a temporary directory. On case-sensitive filesystems, the code does not de-duplicate remote basenames that share the same name. This allows two entries with identical names to be processed sequentially during the same drop operation.
An attacker first sends a drop entry that creates a staged symlink pointing to an arbitrary target path on the local filesystem. The attacker then sends a second entry with the same basename, this time as a regular file. The regular-file handler does not detect or replace the existing symlink before opening the target for writing.
The write operation then follows the attacker-controlled symlink, truncating and overwriting files outside the intended staging directory. Successful exploitation requires user interaction to accept the drag-and-drop operation, but no authentication is required from the attacker.
Root Cause
The regular-file write path uses utils.CreateAt(), which invokes openat(O_RDWR|O_CREAT|O_TRUNC) without the O_NOFOLLOW flag. Without O_NOFOLLOW, the kernel follows symlinks during the open operation, allowing writes outside the staging directory. A related symlink fix was previously applied to the file-transfer code path, but kitten dnd was missed and reproduces on commit 4aa4a5c0567a92553a8c20a88a4352da637fca5d.
Attack Vector
Exploitation requires a victim to perform a drag-and-drop operation from an attacker-controlled remote source into a Kitty terminal session. The attacker crafts a text/uri-list payload containing two entries sharing the same basename: a symlink targeting a sensitive file, followed by a regular-file entry. The write through the symlink completes before final overwrite confirmation runs, defeating the confirmation safeguard.
Detection Methods for CVE-2026-54056
Indicators of Compromise
- Unexpected modification or truncation of files in the Kitty user's home directory or other writable locations following a drag-and-drop event.
- Creation of symlinks inside Kitty's drag-and-drop staging temporary directory pointing to paths outside that directory.
- openat system calls from the Kitty process targeting paths outside the staging directory shortly after a drop operation.
Detection Strategies
- Audit Kitty binary versions across managed endpoints and flag hosts running versions 0.47.0 or 0.47.1.
- Monitor process telemetry for kitten subprocesses performing file writes outside of /tmp or user-specified destinations during drag-and-drop sessions.
- Use file integrity monitoring to detect unexpected truncation events on configuration files and dotfiles owned by users running Kitty.
Monitoring Recommendations
- Enable Linux audit rules for openat syscalls with O_TRUNC originating from the Kitty process.
- Correlate drag-and-drop event timestamps with file modification events across the user home directory.
- Track installation and update events for Kitty packages through endpoint inventory data.
How to Mitigate CVE-2026-54056
Immediate Actions Required
- Upgrade Kitty to version 0.47.2 or later, which patches the symlink-following issue in kitten dnd.
- Inventory all endpoints running affected Kitty versions and prioritize hosts on case-sensitive filesystems.
- Until patched, avoid accepting drag-and-drop operations from untrusted remote sources into Kitty terminals.
Patch Information
Version 0.47.2 fixes the issue by adding O_NOFOLLOW semantics to the regular-file write path in kitten dnd. Refer to the Kitty GitHub Security Advisory GHSA-r892-cv7q-fw8x for full remediation details and the official patch reference.
Workarounds
- Disable or avoid using the kitten dnd remote drag-and-drop feature until upgrading.
- Restrict Kitty usage to trusted contexts where remote drag-and-drop sources cannot be introduced.
- Apply filesystem-level protections such as restrictive directory permissions for sensitive files writable by the Kitty user.
# Verify installed Kitty version and upgrade
kitty --version
# Upgrade to patched release (example using the official installer)
curl -L https://sw.kovidgoyal.net/kitty/installer.sh | sh /dev/stdin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
