CVE-2022-41322: High severity Kitty Project Kitty vulnerability
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/kittyto a version that resolves this vulnerability.Fixed in 0.26.5-5Fixed in 0.41.1-2+deb13u2Fixed in 0.48.2-1.1 - Upgrade
Upgrade
debian/kittyto a version that resolves this vulnerability.Fixed in 0.21.2-2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41322?
CVE-2022-41322 has a critical severity level due to its potential for arbitrary code execution.
How do I fix CVE-2022-41322?
To fix CVE-2022-41322, upgrade Kitty to version 0.26.2 or later.
Can CVE-2022-41322 be exploited remotely?
CVE-2022-41322 requires user interaction to exploit, making it a client-side vulnerability.
What versions of Kitty are affected by CVE-2022-41322?
CVE-2022-41322 affects all versions of Kitty prior to 0.26.2.
Is this vulnerability present in Fedora distributions?
Yes, CVE-2022-41322 affects Fedora 36 and 37 when using vulnerable versions of Kitty.