CVE-2026-54055: Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The os.open() call used to create files does not use ONOFOLLOW, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kittyto a version that resolves this vulnerability.Fixed in 0.47.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54055?
The severity of CVE-2026-54055 is rated as medium with a score of 5.
How do I fix CVE-2026-54055?
To fix CVE-2026-54055, update to Kitty version 0.47.2 or later.
What type of vulnerability is CVE-2026-54055?
CVE-2026-54055 is a local privilege escalation vulnerability caused by a race condition.
What impact does CVE-2026-54055 have on systems?
CVE-2026-54055 allows a child process running in the terminal to write to arbitrary files on the filesystem.
Which versions of Kitty are affected by CVE-2026-54055?
Versions of Kitty prior to 0.47.2 are affected by CVE-2026-54055.