CVE-2026-54055

{
  "id": "CVE-2026-54055",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T20:16:47.450",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Kitty es un terminal multiplataforma basado en GPU. En versiones anteriores a la 0.47.2, existe una vulnerabilidad de escalada de privilegios local en el protocolo de transmisión de archivos de Kitty, donde un proceso hijo ejecutándose en el terminal puede escribir en archivos arbitrarios en el sistema de archivos explotando una condición de carrera TOCTOU (Time-of-Check-Time-of-Use) entre la validación de symlinks y la creación de archivos. La llamada “os.open()” utilizada para crear archivos no utiliza “O_NOFOLLOW”, permitiendo a un atacante crear un symlink entre la comprobación stat inicial y la apertura real del archivo, haciendo que la escritura siga el symlink a un destino arbitrario. La versión 0.47.2 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kovidgoyal",
          "product": "kitty",
          "versions": [
            {
              "version": "< 0.47.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T18:43:37.469547Z",
          "id": "CVE-2026-54055",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        },
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.47.2",
              "matchCriteriaId": "5667270C-3C0A-48E0-B817-5B753E6952AC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}