Nixpkgs security tracker

Untriaged

Permalink CVE-2026-42851

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

created 1 month, 4 weeks ago Activity log

Created suggestion 1 month, 4 weeks ago

@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

References

https://github.com/kovidgoyal/kitty/security/advisories/GHSA-w98g-hpvr-r332 x_refsource_CONFIRM

Affected products

kitty

==< 0.47.0

Matching in nixpkgs

pkgs.kitty

Fast, feature-rich, GPU based terminal emulator

nixos-unstable 0.47.0
- nixpkgs-unstable 0.47.1
- nixos-unstable-small 0.47.1
nixos-26.05 -
- nixos-26.05-small 0.47.0
- nixpkgs-26.05-darwin 0.47.0

pkgs.kittysay

Cowsay, but with a cute kitty :3

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 -
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.kitty-img

Print images inline in kitty

nixos-unstable 1.1.0
- nixpkgs-unstable 1.1.0
- nixos-unstable-small 1.1.0
nixos-26.05 -
- nixos-26.05-small 1.1.0
- nixpkgs-26.05-darwin 1.1.0

pkgs.kitty-themes

Themes for the kitty terminal emulator

nixos-unstable 0-unstable-2026-03-31
- nixpkgs-unstable 0-unstable-2026-03-31
- nixos-unstable-small 0-unstable-2026-03-31
nixos-26.05 -
- nixos-26.05-small 0-unstable-2026-03-31
- nixpkgs-26.05-darwin 0-unstable-2026-03-31

pkgs.kittycad-kcl-lsp

KittyCAD KCL language server

nixos-unstable 0.1.71
- nixpkgs-unstable 0.1.71
- nixos-unstable-small 0.1.71
nixos-26.05 -
- nixos-26.05-small 0.1.71
- nixpkgs-26.05-darwin 0.1.71

pkgs.mailman-hyperkitty

Mailman archiver plugin for HyperKitty

nixos-unstable 1.2.1
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1
nixos-26.05 -
- nixos-26.05-small 1.2.1
- nixpkgs-26.05-darwin 1.2.1

pkgs.haskellPackages.discokitty

DisCoCat implementation

nixos-unstable 0.1.0
- nixpkgs-unstable 0.1.0
- nixos-unstable-small 0.1.0
nixos-26.05 -
- nixos-26.05-small 0.1.0
- nixpkgs-26.05-darwin 0.1.0

pkgs.mailmanPackages.hyperkitty

Archiver for GNU Mailman v3

nixos-unstable 1.3.12
- nixpkgs-unstable 1.3.12
- nixos-unstable-small 1.3.12
nixos-26.05 -
- nixos-26.05-small 1.3.12
- nixpkgs-26.05-darwin 1.3.12

pkgs.mailmanPackages.mailman-hyperkitty

Mailman archiver plugin for HyperKitty

nixos-unstable 1.2.1
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1
nixos-26.05 -
- nixos-26.05-small 1.2.1
- nixpkgs-26.05-darwin 1.2.1

pkgs.vimPlugins.nvim-treesitter-parsers.kitty

None

nixos-unstable 0.0.0+rev=fa6ab3f
- nixpkgs-unstable 0.0.0+rev=fa6ab3f
- nixos-unstable-small 0.0.0+rev=fa6ab3f
nixos-26.05 -
- nixos-26.05-small 0.0.0+rev=fa6ab3f
- nixpkgs-26.05-darwin 0.0.0+rev=fa6ab3f

Untriaged

Permalink CVE-2026-42850

7.4 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 4 weeks ago Activity log

Created suggestion 1 month, 4 weeks ago

Kitty has a shell command injection

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.