CVE-2026-54057: Kitty vulnerable to command injection via unsanitized OSC 21 query reply
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kittyto a version that resolves this vulnerability.Fixed in 0.47.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54057?
The severity of CVE-2026-54057 is high with a CVSS score of 7.3.
How do I fix CVE-2026-54057?
To fix CVE-2026-54057, update Kitty to version 0.47.3 or later.
What vulnerability does CVE-2026-54057 exploit?
CVE-2026-54057 exploits a command injection vulnerability through unsanitized OSC 21 query replies.
Which versions of Kitty are affected by CVE-2026-54057?
Versions of Kitty prior to 0.47.3 are affected by CVE-2026-54057.
What is affected by the CVE-2026-54057 vulnerability?
CVE-2026-54057 affects the shell input handling of Kitty's terminal when processing OSC 21 control commands.