CVE-2026-95832
Received Received - Intake

Command Injection in Kitty Terminal Emulator

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Secur0

Description
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-95832
EUVD
EUVD-2026-87065

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kovid kitty to 0.49.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of special characters in the kitty terminal emulator. An attacker can inject commands into the terminal by exploiting escape sequences, which are then executed by the user's shell. The issue arises when the terminal processes unrecognized field names in color control escape codes and forwards them without proper sanitization.

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary commands on your system with the same privileges as the user running the terminal. This could lead to data theft, malware installation, or unauthorized system access. The attack is possible even without direct access to the terminal, as it can be triggered remotely through crafted escape sequences.

Mitigation Strategies

Update kitty to version 0.49.0 or later to address the improper neutralization issue in the colour control escape code handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart