CVE-2026-80430 Kovid Goyal CVE debrief

Who should care

Defenders responsible for systems using kitty should assess exposure and prioritize patching. This includes reviewing kitty versions in use, applying patches, and monitoring for suspicious activity. Additionally, defenders should consider implementing compensating controls, such as restricting terminal access to trusted programs and enhancing logging and monitoring capabilities.

Why it matters

CVE-2026-80430 allows a program writing to the terminal to create files and directories outside the staging directory in kitty versions from 0.47.0 before 0.49.0. Defenders should prioritize verifying kitty versions and applying patches to prevent unauthorized file creation.

• Potential unauthorized file creation
• Possible escalation of privileges
• Required verification of kitty versions
• Necessary monitoring for suspicious activity

Technical summary

The vulnerability exists in kitty's drag and drop protocol, allowing a program writing to the terminal to create files and directories outside the staging directory. This issue is due to improper link resolution before file access. The vulnerability arises from the way kitty resolves descendant paths in the staged item tree. A client can declare two entries with the same name, the first a symlink whose target is an arbitrary absolute path and the second a directory, causing mkdirat() to fail with EEXIST, which the code ignores, and causing the subsequent path resolution to follow the symlink and return a directory descriptor outside the staging directory.

Defensive priority

Defenders should prioritize verifying kitty versions and applying patches to prevent unauthorized file creation.

Recommended defensive actions

• Verify kitty version and apply patches
• Restrict terminal access to trusted programs
• Monitor for suspicious file creation
• Implement additional logging and monitoring
• Conduct regular vulnerability assessments
• Review and update incident response plans
• Ensure proper configuration of kitty and related systems

Evidence notes

The CVE record and NVD vulnerability detail provide information on the issue. Additional details are available in the source references. The vulnerability is caused by improper link resolution in kitty's drag and drop protocol, which allows a program writing to the terminal to create files and directories outside the staging directory. The issue exists in kitty versions from 0.47.0 before 0.49.0. The CVE record and NVD vulnerability detail provide information on the issue. The kitty commit references provide additional technical depth

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.