The flaw allows an attacker to inject arbitrary shell commands into the child shell’s input by sending a chain of @kitty-echo and @kitty-ssh DCS escape sequences. Because the handlers accept printable characters or a newline without authentication, a malicious terminal output can trigger execution of attacker‑controlled code. This gives the attacker the same privileges as the terminal process, potentially allowing them to read, modify, or delete files, install malware, or disrupt services. The weakness is rooted in command injection (CWE‑77, CWE‑78), improper privilege handling (CWE‑150), and unsanitized terminal input (CWE‑93).

The vulnerability is present in the Kitty terminal emulator written by Kovid Goyal. Any installation of kitty prior to version 0.48.2 on Linux, macOS, or Windows is vulnerable, regardless of the host operating system. The issue is tied specifically to the @kitty-echo and @kitty-ssh handlers in the window module.

The CVSS score of 7.3 reflects a high severity rating. The EPSS score of 0.00146 indicates the likelihood of exploitation is low but not zero, and the flaw is not listed in the CISA KEV catalog. Attackers can trigger the injection by crafting terminal output that a user will render; it is likely that unattended terminals or shared session setups could be targeted. Since the injection is performed via an unauthenticated channel, the risk is amplified when trust boundaries around terminal output are insufficient.