KI
Product
kitty
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 7Medium 1Low 0
Watch
Add kitty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33642 | 9.8 | May 19 | Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check Affected: < 0.47.0 |
| CVE-2020-35605 | 9.8 | Dec 21 | The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be… Affected: before 0.19.3 |
| CVE-2026-42850 | 8.8 | Jun 12 | Kitty has a shell command injection Affected: < 0.47.0 |
| CVE-2026-33633 | 8.8 | May 19 | Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler Affected: < 0.47.0 |
| CVE-2026-54057 | 7.8 | Jun 12 | Kitty vulnerable to command injection via unsanitized OSC 21 query reply Affected: < 0.47.3 |
| CVE-2026-42851 | 7.8 | Jun 12 | @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE Affected: < 0.47.0 |
| CVE-2025-43929 | 7.8 | Apr 20 | open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a… Affected: before 0.41.0 |
| CVE-2026-72913 | 7.3 | Aug 10 | Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences Affected: < 0.48.2 |
| CVE-2026-54056 | 7.1 | Jun 12 | Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging Affected: >= 0.47.0, < 0.47.2 |
| CVE-2026-54055 | 5.0 | Jun 12 | Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol Affected: < 0.47.2 |
Showing 10