Nixpkgs security tracker
NIXPKGS-2026-2391
GitHub issue
published 13 hours ago
Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences
Permalink
CVE-2026-72913
7.3 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): Passive (P)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Passive (P)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
9 packages
- kittysay
- kitty-img
- kitty-themes
- kittycad-kcl-lsp
- mailman-hyperkitty
- haskellPackages.discokitty
- mailmanPackages.hyperkitty
- mailmanPackages.mailman-hyperkitty
- vimPlugins.nvim-treesitter-parsers.kitty
- @LeSuisse accepted
- @LeSuisse published on GitHub
Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
References
-
https://github.com/kovidgoyal/kitty/security/advisories/GHSA-ccp2-q4v6-rw94 x_refsource_CONFIRM
-
https://github.com/kovidgoyal/kitty/releases/tag/v0.48.2 x_refsource_MISC
-
https://sw.kovidgoyal.net/kitty/changelog/#id1 x_refsource_MISC
Affected products
kitty
- ==< 0.48.2
Matching in nixpkgs
pkgs.kitty
Fast, feature-rich, GPU based terminal emulator
Ignored packages (9)
pkgs.kittysay
Cowsay, but with a cute kitty :3
pkgs.kitty-img
Print images inline in kitty
pkgs.kitty-themes
Themes for the kitty terminal emulator
-
nixos-unstable 0-unstable-2026-06-08
- nixpkgs-unstable 0-unstable-2026-06-08
- nixos-unstable-small 0-unstable-2026-07-10
-
nixos-26.05 0-unstable-2026-03-31
- nixos-26.05-small 0-unstable-2026-03-31
- nixpkgs-26.05-darwin 0-unstable-2026-03-31
pkgs.kittycad-kcl-lsp
KittyCAD KCL language server
pkgs.mailman-hyperkitty
Mailman archiver plugin for HyperKitty
pkgs.haskellPackages.discokitty
DisCoCat implementation
pkgs.mailmanPackages.hyperkitty
Archiver for GNU Mailman v3
pkgs.mailmanPackages.mailman-hyperkitty
Mailman archiver plugin for HyperKitty
pkgs.vimPlugins.nvim-treesitter-parsers.kitty
Tree-sitter grammar for kitty
-
nixos-unstable 0.0.0+rev=fa6ab3f
- nixpkgs-unstable 0.0.0+rev=fa6ab3f
- nixos-unstable-small 0.0.0+rev=0e3eca6
-
nixos-26.05 0.0.0+rev=fa6ab3f
- nixos-26.05-small 0.0.0+rev=fa6ab3f
- nixpkgs-26.05-darwin 0.0.0+rev=fa6ab3f
Package maintainers
-
@kashw2 Keanu Ashwell <supra4keanu@hotmail.com>
-
@rvolosatovs Roman Volosatovs <rvolosatovs@riseup.net>
-
@leiserfg Leiser Fernández Gallo <leiserfg@gmail.com>
-
@Luflosi Luflosi <luflosi@luflosi.de>
-
@carlossless Karolis Stasaitis <contact@carlossless.io>