CVE-2026-54056

{
  "id": "CVE-2026-54056",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T21:16:24.463",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue."
    },
    {
      "lang": "es",
      "value": "Kitty es una terminal multiplataforma basada en GPU. En las versiones 0.47.0 y 0.47.1, “kitten dnd” puede permitir que un origen malicioso remoto de arrastrar y soltar sobrescriba o trunque archivos arbitrarios escribibles por el usuario local de kitty. Los elementos remotos soltados de “text/uri-list” se almacenan provisionalmente en un directorio temporal, pero en sistemas de archivos que distinguen entre mayúsculas y minúsculas, los nombres base remotos duplicados no se desduplican. Un atacante puede primero crear un enlace simbólico provisional y luego enviar una entrada de archivo regular con el mismo nombre. La escritura del archivo regular utiliza “utils.CreateAt()” / “openat(O_RDWR|O_CREAT|O_TRUNC)” sin “O_NOFOLLOW”, por lo que sigue el enlace simbólico creado por el atacante y escribe fuera del directorio provisional antes de que se ejecute la confirmación final de sobrescritura. Esto parece relacionado en su tipo con el aviso de enlace simbólico de transferencia de archivos, pero es un error diferente: afecta a la preparación remota de arrastrar y soltar de “kitten dnd”, utiliza código vulnerable diferente (“kittens/dnd/drop.go” y “tools/utils/file_at_fd.go”), y se reproduce en el commit “4aa4a5c0567a92553a8c20a88a4352da637fca5d”, después de la corrección de “O_NOFOLLOW” para la transferencia de archivos. La versión 0.47.2 soluciona el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kovidgoyal",
          "product": "kitty",
          "versions": [
            {
              "version": ">= 0.47.0, < 0.47.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.7
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T13:02:47.195998Z",
          "id": "CVE-2026-54056",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.47.0",
              "versionEndExcluding": "0.47.2",
              "matchCriteriaId": "E68DF582-51E7-4585-9070-2CA8F562D842"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}