CVE-2025-43929

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-20 · updated 2026-06-17
Weakness: CWE-346

Description

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

Affected products

kovidgoyal kitty: before 0.41.0 — fixed in 0.41.0

How to fix

Upgrade to a fixed version: kovidgoyal kitty 0.41.0. Check the vendor advisory for mitigations.

References

https://ghostwriter.kde.org/documentation/#links
https://github.com/0xBenCantCode/CVE-2025-43929
https://github.com/kovidgoyal/kitty/commit/ce5cfdd9caf44c538af800a07162e1f49bd53c35
https://github.com/kovidgoyal/kitty/compare/v0.40.1...v0.41.0
https://hitman.services/cve-2025-43929/

Get alerted when CVE-2025-43929 or the next vulnerability affects your stack