CVE-2026-42851 @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
An attacker can execute arbitrary Python code in the Kitty terminal process by sending crafted escape sequences, requiring no user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42851?
CVE-2026-42851 is a high-severity code injection vulnerability in kovidgoyal kitty, published on 12 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
Which versions are affected by CVE-2026-42851?
It affects 1 product.
Products include Kovidgoyal Kitty.
How do I fix CVE-2026-42851?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-42851 being exploited?
There is no known exploitation of CVE-2026-42851 in the wild and no public exploit code.
Other vulnerabilities in kovidgoyal kitty
- CVE-2026-33642 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
- CVE-2026-54056 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
- CVE-2026-33633 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
- CVE-2026-42850 Kitty has a shell command injection
- CVE-2026-54057 Kitty vulnerable to command injection via unsanitized OSC 21 query reply
Sources
Also known as DEBIAN-CVE-2026-42851, GHSA-w98g-hpvr-r332, UBUNTU-CVE-2026-42851.