CVE-2026-54057
Kitty vulnerable to command injection via unsanitized OSC 21 query reply
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
| CWE | CWE-94 CWE-150 |
| Vendor | kovidgoyal |
| Product | kitty |
| Published | Jun 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for kovidgoyal kitty
Be the first to know when new unknown vulnerabilities affecting kovidgoyal kitty are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
kovidgoyal / kitty
< 0.47.3