CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences
Attackers can execute arbitrary commands in the child shell by chaining DCS escape sequences when a user displays untrusted terminal data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-72913?
CVE-2026-72913 is a high-severity command injection vulnerability in kovidgoyal kitty, published on 10 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
Which versions are affected by CVE-2026-72913?
How do I fix CVE-2026-72913?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-72913 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72913 exists.
Sources
Also known as DEBIAN-CVE-2026-72913, GHSA-ccp2-q4v6-rw94, UBUNTU-CVE-2026-72913.