What’s Vulnerable › Products

kovidgoyal kitty vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your kovidgoyal kitty version is affected

Latest kovidgoyal kitty vulnerabilities

• CVE-2026-72913 — Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences (CVSS 7.3)
• CVE-2026-54057 — Kitty vulnerable to command injection via unsanitized OSC 21 query reply (CVSS 7.8)
• CVE-2026-54056 — Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging (CVSS 7.1)
• CVE-2026-54055 — Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol (CVSS 5.0)
• CVE-2026-42851 — @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE (CVSS 7.8)
• CVE-2026-42850 — Kitty has a shell command injection (CVSS 8.8)
• CVE-2026-33642 — Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check (CVSS 9.8)
• CVE-2026-33633 — Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler (CVSS 8.8)
• CVE-2025-43929 — (CVSS 7.8)
• CVE-2020-35605 — (CVSS 9.8)