CVE-2026-54057 Kitty vulnerable to command injection via unsanitized OSC 21 query reply
An attacker can execute arbitrary commands by sending unsanitized OSC 21 query replies to the Kitty terminal emulator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54057?
CVE-2026-54057 is a high-severity command injection vulnerability in kovidgoyal kitty, published on 12 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
Which versions are affected by CVE-2026-54057?
It affects 1 product.
Linux distribution packages (1)
kitty openSUSE:Tumbleweed | All versions | 0.47.3-1.1 |
Products include Kovidgoyal Kitty.
How do I fix CVE-2026-54057?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-54057 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54057 exists.
Other vulnerabilities in kovidgoyal kitty
- CVE-2026-33642 Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
- CVE-2026-42851 @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
- CVE-2026-54056 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
- CVE-2026-33633 Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
- CVE-2026-42850 Kitty has a shell command injection
Sources
Also known as DEBIAN-CVE-2026-54057, GHSA-5gmr-9gwg-hhq6, UBUNTU-CVE-2026-54057, openSUSE-SU-2026:11021-1.