USN-8763-1: kitty vulnerabilities
Ubuntu patches three kitty terminal flaws including remote command execution via crafted escape sequences.
Ubuntu Security Notice USN-8763-1 fixes multiple vulnerabilities in the kitty terminal emulator. CVE-2026-42850 allows a remote attacker to execute arbitrary commands via improperly escaped error messages triggered by crafted terminal escape sequences. CVE-2026-42851 enables arbitrary code execution with the user's privileges through mishandled remote edit requests in terminal output. CVE-2026-54055 lets a local attacker overwrite arbitrary files via destination paths in kitty's file transmission protocol.
- CVE-2026-42850: remote command execution via crafted terminal escape sequences in error messages
- CVE-2026-42851: arbitrary code execution with user privileges via remote edit requests
- CVE-2026-54055: local arbitrary file overwrite via file transmission protocol paths
- Terminal users exposed when rendering attacker-controlled output from remote systems
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-42851+2 related CVEs | Kitty: A program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email… | 7.8 group max | <1% | PoC |
From the original article
It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-42850) It was discovered that kitty incorrectly handled remote edit requests in terminal output.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.