CVE-2026-42851

{
  "id": "CVE-2026-42851",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T20:16:45.420",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Kitty es un terminal multiplataforma basado en GPU. En versiones anteriores a la 0.47.0, un programa capaz de escribir bytes en un terminal kitty - un par SSH remoto, un archivo descargado visto con ’cat’, una línea de registro, un cuerpo de correo electrónico renderizado en ’less’, un cuerpo de incidencia en una TUI, etc. - puede hacer que kitty ejecute Python suministrado por el atacante dentro del proceso kitty en ejecución, con los privilegios completos del usuario. No hay solicitud de aprobación, ningún requisito de permiso de control remoto, ninguna interacción de integración de shell, ningún acceso al portapapeles y ninguna interacción con el editor. La versión 0.47.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kovidgoyal",
          "product": "kitty",
          "versions": [
            {
              "version": "< 0.47.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T03:56:02.774347Z",
          "id": "CVE-2026-42851",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.47.0",
              "matchCriteriaId": "F5F5CC5E-DE6C-4B63-BE58-D083F148C37B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}