The vulnerability in prior versions of kitty allows attackers to inject shell commands through a specially crafted escape code that triggers an unescaped error. Because the terminal echoes the error string with carriage‑return and line‑feed characters, the victim’s active shell interprets it as a command. An attacker who can connect using a netcat‑style listener can therefore execute arbitrary commands on the victim’s machine, resulting in full compromise of confidentiality, integrity, and availability. This flaw is a classic command injection, mapped to CWE‑77.

The issue affects the kitty terminal emulator developed by Kovid Goyal. Any installation running a version earlier than 0.47.0 on any operating system supported by kitty – Windows, macOS or Linux – is vulnerable. Versions post‑0.47.0 incorporate the fix and are not impacted.

The CVSS score of 7.4 indicates high severity, while the EPSS score of less than 1 % shows a low projected exploitation probability at this time. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires the attacker to establish a network connection that allows kitty to deliver the malicious escape sequence; typical vectors involve a netcat listener or any service that can inject data into the local terminal. If successful, the attacker can run arbitrary commands on the victim’s account. Because the flaw is remote but depends on a network connection to the terminal, defensive actions should focus on restricting such inbound connections and applying the patch promptly.