CVE-2026-42850: Kitty Terminal Command Injection via Escape Sequence Flaw

Technical summary

CVE-2026-42850 exploits insufficient input sanitization in Kitty's escape sequence handling. When Kitty processes a specially crafted escape code, it generates an error response that fails to properly escape shell metacharacters. The error output, combined with CRLF line termination, causes the shell to interpret the error message as executable code. The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS 3.1 score of 8.8 (HIGH) reflects high impact across confidentiality, integrity, and availability with no privilege requirement and low attack complexity, though user interaction is required.

Business impact

Successful exploitation enables complete system compromise—an attacker gains the ability to execute arbitrary commands with the privileges of the user running Kitty. For organizations where developers, sysadmins, or security teams use Kitty as their primary terminal, this creates a direct path to lateral movement and data exfiltration. The attack surface is limited by the requirement that the victim must actively connect to or accept a connection from the attacker, reducing the risk of mass exploitation. However, social engineering or watering-hole attacks could amplify exposure. Teams should prioritize patching across development workstations and jump hosts.

Affected systems

Kitty versions prior to 0.47.0 are vulnerable across all supported platforms (Linux, macOS, and other Unix-like systems). The vulnerability does not affect Kitty 0.47.0 and later. Organizations using older versions in containerized or cloud environments may face higher exposure if users connect to untrusted networks or services.

Exploitability

Exploitation requires two conditions: (1) the victim's Kitty must be running a vulnerable version, and (2) the victim must establish a network connection to an attacker-controlled resource or listen for inbound connections. An attacker cannot remotely trigger this without user participation. However, once connected, crafting the malicious escape sequence is straightforward. The requirement for user interaction lowers the CVSS base attack vector from local-only, but does not require administrative interaction—a regular user opening a connection suffices. This is not a 'wormable' vulnerability, but it is readily exploitable in targeted or social-engineering scenarios.

Remediation

Upgrade Kitty to version 0.47.0 or later. Verify the installed version with 'kitty --version'. Package managers (apt, brew, pip) typically provide the patched version; users building from source should pull the latest release tag. No workarounds mitigate the vulnerability short of avoiding Kitty or restricting network connections to trusted systems only.

Patch guidance

Users should update Kitty to 0.47.0 or newer as soon as practicable. Linux distribution maintainers should push updates to their repositories; macOS users via Homebrew should see automatic updates in brew upgrade. Users on air-gapped or restricted networks should verify patch availability through their software supply chain. No staged rollout is necessary—patch urgency is high for any user who connects Kitty to untrusted networks or services. Verify successful update by confirming the version number post-installation.

Detection guidance

Monitor for unusual escape sequence usage or suspicious error patterns in terminal logs. Detection in real-time is difficult without application-level logging; however, security teams can (1) inventory Kitty versions across the organization using endpoint detection and response (EDR) or software asset management tools, and (2) flag any system running Kitty <0.47.0 as a remediation priority. Network-based detection is limited since the attack exploits protocol semantics rather than network behavior. Focus detection efforts on identifying unpatched instances and validating successful patch deployment.

Why prioritize this

Although the CVSS score is high (8.8), the practical impact is moderated by strict preconditions—an attacker must establish a network connection and entice the victim to connect or listen. This makes it lower-priority than unauthenticated remote code execution vulnerabilities, but higher-priority than vulnerabilities requiring local access. Teams should prioritize patching development machines, CI/CD runners, and any systems where Kitty users regularly connect to external systems or receive inbound connections.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and user interaction required (UI:R). Impact is High across confidentiality (C:H), integrity (I:H), and availability (A:H)—code execution grants full system control. The 'User Interaction' requirement prevents a perfect 9.8, as exploitation depends on the victim connecting to the attacker. The HIGH severity designation is appropriate; this is a serious vulnerability for any organization where technical staff use Kitty, but not an across-the-board critical emergency for those who don't or who restrict network access.

Frequently asked questions