CVE-2026-54056: Kitty Terminal Drag-and-Drop Symlink File Overwrite Vulnerability

Technical summary

The vulnerability exists in Kitty's remote drag-and-drop (kitten dnd) handler, specifically in how it processes `text/uri-list` MIME type drops. When staging remote files, the code fails to de-duplicate entries that share the same basename on case-sensitive filesystems. An attacker creates a staged symlink with a target name, then sends a malicious `text/uri-list` entry with the same name. The file-writing operation in `kittens/dnd/drop.go` and `tools/utils/file_at_fd.go` calls `utils.CreateAt()` with flags `O_RDWR|O_CREAT|O_TRUNC` but omits the `O_NOFOLLOW` flag. This causes the kernel to follow the attacker-created symlink, writing the attacker-controlled content to the symlink target before the application performs its final overwrite confirmation. The flaw is distinct from a prior file-transfer symlink issue and persists even after related O_NOFOLLOW fixes were applied. Affected versions: 0.47.0, 0.47.1. Patched in: 0.47.2.

Business impact

For organizations where employees use Kitty as their terminal of choice (common among developers and DevOps teams), this vulnerability creates a targeted file-corruption risk. An attacker who can either (a) control a drag-and-drop source the user interacts with, or (b) perform a man-in-the-middle attack on remote file transfers, can corrupt or overwrite application configuration files, credentials stored in accessible locations, scripts, or build artifacts—potentially disrupting CI/CD pipelines or compromising development environments. The requirement for user interaction and case-sensitive filesystem limits exposure, but the impact on high-value development machines could be significant.

Affected systems

Kitty version 0.47.0 and 0.47.1 on case-sensitive filesystems (Linux, macOS) are affected. The vulnerability does not apply to case-insensitive filesystems (e.g., standard Windows NTFS or macOS with case-insensitive HFS+). Any user running a vulnerable Kitty version and performing drag-and-drop operations with potentially untrusted remote sources is at risk.

Exploitability

Exploitation requires user interaction—specifically, a user must initiate a drag-and-drop operation from an attacker-controlled or compromised remote source into a Kitty window. The attacker must also be able to influence the contents and structure of that remote source (e.g., control a web server, FTP server, or network share). The attack is not remotely exploitable without user involvement. CVSS 3.1 score of 7.6 (HIGH) reflects the moderate complexity and user-interaction requirement combined with the significant integrity impact. No public exploit code is known at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade to Kitty version 0.47.2 or later. This patch adds proper `O_NOFOLLOW` handling to the drag-and-drop file-writing code path. Users unable to upgrade immediately should avoid dragging and dropping files from untrusted or unfamiliar remote sources into Kitty on case-sensitive filesystems. Disabling drag-and-drop functionality (if available via configuration) is an alternative mitigation.

Patch guidance

Verify the installed Kitty version via `kitty --version` or the application's help menu. If running 0.47.0 or 0.47.1, update to 0.47.2 through your package manager (e.g., `brew upgrade kitty` on macOS, package manager updates on Linux) or download the latest release from the official Kitty GitHub repository. Confirm the updated version is in use before resuming drag-and-drop workflows with remote sources. No configuration changes or additional hardening is required after patching.

Detection guidance

Monitor filesystem activity for unexpected symlink creation in Kitty's temporary staging directories (typically under /tmp on Linux or /var/folders on macOS). Watch for file writes that cross symlink boundaries or are directed to unexpected locations with the same timestamp as drag-and-drop activity. Log user drag-and-drop interactions in environments where this can be audited. If suspicious file modifications occur coinciding with drag-and-drop activity, investigate the source of the dropped content and review any newly modified files in the user's home directory or application configuration paths.

Why prioritize this

This vulnerability merits prompt patching for development-focused organizations where Kitty adoption is high. Although the attack requires user interaction, the integrity impact is meaningful—an attacker can corrupt or overwrite files, potentially affecting software builds, configuration, and development workflows. The case-sensitive filesystem limitation reduces the threat surface in some environments but not in typical Linux development setups. The 7.6 CVSS score and the relative ease of update make this a medium-to-high priority for vulnerability programs tracking development tools.

Risk score, explained

CVSS 3.1 score of 7.6 (HIGH) is derived from: (AV:N) network-adjacent attack vector—the attacker need not be local but interaction is required; (AC:L) low attack complexity—no special conditions beyond crafting a malicious drag-and-drop source; (PR:L) low privilege—the user must be logged in and running Kitty, but no elevated privileges are needed to trigger the flaw; (UI:R) user interaction required—the user must perform the drag-and-drop action; (S:C) scope changed—the attack can affect resources beyond Kitty's immediate security scope; (C:N) no confidentiality impact—files are not read; (I:H) high integrity impact—files can be overwritten or truncated; (A:L) low availability impact—file truncation can degrade availability of affected resources. The user-interaction and case-sensitive filesystem requirements prevent a critical rating despite the integrity risk.

Frequently asked questions