Executive Summary

CVE-2026-42850 is a high-severity shell command injection vulnerability in the kitty terminal emulator versions prior to 0.47.0.

The flaw allows an attacker to execute arbitrary commands on a victim's system by exploiting an error in kitty's handling of a special escape code. This escape code triggers an error that is not properly escaped and is echoed back to the terminal, causing the shell to run the injected commands.

To exploit this vulnerability, the victim must connect to the attacker using netcat or a similar program, or the attacker must listen for an incoming connection. Once connected, the attacker can run commands on the victim's system through the specially crafted kitty escape code.

This issue was fixed in kitty version 0.47.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to gain control over your computer by executing arbitrary shell commands remotely.

The attacker can compromise the confidentiality and integrity of your system by running malicious commands once a connection is established.

However, the attack requires the victim to initiate a connection to the attacker, and it involves high attack complexity and active user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual or suspicious usage of netcat or similar programs that connect to external hosts, as exploitation requires the victim to initiate such a connection.

Additionally, detection can focus on identifying the presence of the special kitty escape code '\x1bP@kitty-ssh|...' in terminal input or logs, which triggers the vulnerability.

Commands to help detect potential exploitation attempts might include:

• Using network monitoring tools (e.g., tcpdump or Wireshark) to capture and analyze outgoing connections initiated by netcat or similar tools.
• Searching shell history or terminal logs for the escape sequence '\x1bP@kitty-ssh|...' or unusual error messages related to kitty.
• Example command to search for the escape code in logs: grep -a $'\x1bP@kitty-ssh|' /path/to/terminal/logs

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the kitty terminal emulator to version 0.47.0 or later, where this vulnerability has been fixed.

Until the upgrade can be applied, avoid using netcat or similar programs to connect to untrusted hosts through kitty, as the exploit requires such a connection.

Additionally, restrict or monitor network connections initiated from systems running vulnerable versions of kitty to reduce the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to execute arbitrary commands on a victim's system, potentially compromising confidentiality and integrity of data.

Such unauthorized command execution could lead to unauthorized access to sensitive personal or health information, which may result in non-compliance with regulations like GDPR and HIPAA that require protection of data confidentiality and integrity.

However, the exploit requires the victim to initiate a network connection to the attacker, which may limit the risk in some environments.

Useful 0 Not Useful 0