CVE-2026-80432 Kovid Goyal CVE debrief

Who should care

Users and administrators of kitty terminal emulator, especially those handling sensitive files and data, should be aware of this vulnerability and take necessary precautions to mitigate the risk. This includes reviewing and updating kitty to version 0.49.0 or later, restricting access to sensitive files and directories, and monitoring terminal emulator usage for suspicious activity. Additionally, operators, platform administrators, and security teams may

Why it matters

CVE-2026-80432 vulnerability in kitty terminal emulator allows unauthorized access to file contents, increasing the risk of data breaches and requiring additional monitoring and access controls.

• Potential unauthorized access to sensitive file contents
• Increased risk of data breaches
• Need for additional monitoring and access controls

Technical summary

The vulnerability is caused by a missing authorization check in the drop handling path of the drag and drop protocol in kitty. This allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. The vulnerability arises from a missing authorization in the drop handling path of the drag and drop protocol in kitty, allowing unauthorized access to file contents.

Defensive priority

Medium priority for terminal emulator users and administrators

Recommended defensive actions

• Review and update kitty to version 0.49.0 or later
• Restrict access to sensitive files and directories
• Monitor terminal emulator usage for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by a missing authorization check in the drop handling path of the drag and drop protocol in kitty. This allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.