CVE-2026-95832 Kovid Goyal CVE debrief

Who should care

Defenders responsible for systems using kitty, particularly those with untrusted programs writing to the terminal, should assess exposure and prioritize updates to mitigate this vulnerability.

Why it matters

CVE-2026-95832 is a critical vulnerability in kitty that allows arbitrary command execution. Defenders should prioritize updates and assess exposure.

• Execution of arbitrary commands with user privileges
• Potential for lateral movement if exploited in a multi-user environment
• Need for verification of kitty version and exposure

Technical summary

The color control escape code handler in kitty is vulnerable to improper neutralization of special elements, allowing a program writing to the terminal to execute an arbitrary command in the user's shell. The issue arises from color_control() in kitty/window.py answering a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The vulnerability is fixed in kitty version 0.49.0.

Defensive priority

Defenders should prioritize updating kitty to version 0.49.0 or later to mitigate this vulnerability. Systems using kitty should be assessed for exposure, particularly those with untrusted programs writing to the terminal.

Recommended defensive actions

• Update kitty to version 0.49.0 or later
• Assess systems using kitty for exposure
• Verify that untrusted programs are not writing to the terminal
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. Additional details are available from source references, including GitHub commits and release notes. The vulnerability affects kitty versions from 0.47.3 before 0.49.0. Defenders should verify kitty version and exposure. The payload is reduced to printable ASCII before the field name is echoed. A newline is available from handle_remote_ssh() in kitty/window.py. This vulnerability allows a program writing to the terminal to execute an arbitrary command in the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.