CVE-2026-72913: Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kittyto a version that resolves this vulnerability.Fixed in 0.48.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72913?
CVE-2026-72913 has a risk score of 62, indicating a medium-level severity.
How do I fix CVE-2026-72913?
To mitigate CVE-2026-72913, upgrade Kitty to version 0.48.2 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-72913?
CVE-2026-72913 is classified as a command injection vulnerability due to unauthenticated data being written to the child shell's stdin.
Which components of Kitty are affected by CVE-2026-72913?
The @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py are the components impacted by CVE-2026-72913.
When was CVE-2026-72913 published?
CVE-2026-72913 was published on August 10, 2026.