Description
Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.
Published: 2026-09-25
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises when the kitty terminal emulator processes a drag‑and‑drop event without first verifying that a drop actually occurred. As a result, a client program that writes to the terminal can request the dragged data while the file is merely hovering over the window. The kitty process then reads the offered file paths directly from the filesystem, returning the file contents to the requester, allowing an unintended disclosure of file contents even if the user never completes the drop or releases the data.

Affected Systems

The issue affects the kitty terminal emulator from Kovid Goyal, specifically versions 0.47.0 through versions just before 0.49.0. All users of these releases on any operating system are vulnerable until they upgrade to kitty 0.49.0 or later.

Risk and Exploitability

The CVSS score of 6 indicates moderate severity. EPSS is not available, so the likelihood of current exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local: a program having write access to the terminal can issue the unauthorized drag‑data request, bypassing user interaction. Because the data is read from the filesystem by the kitty process, the disclosure could affect any files that the user drags over the window. While no public exploit has been documented, the design flaw provides a clear path for disclosure without user confirmation.

Generated by OpenCVE AI on September 25, 2026 at 18:32 UTC.

Remediation

Vendor Solution

Upgrade to kitty 0.49.0 or later.

OpenCVE Recommended Actions

  • Upgrade kitty to version 0.49.0 or later to apply the authorization check.
  • Disable drag‑and‑drop in kitty configuration if an upgrade cannot be performed (e.g., set enable_drag_and_drop = false).
  • Limit terminal write access to trusted processes and consider using SELinux/AppArmor to confine kitty and monitor for unauthorized data requests.

Generated by OpenCVE AI on September 25, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.
Title Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop
First Time appeared Kovidgoyal
Kovidgoyal kitty
Weaknesses CWE-862
CPEs cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*
Vendors & Products Kovidgoyal
Kovidgoyal kitty
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Kovidgoyal Kitty
cve-icon MITRE

Status: PUBLISHED

Assigner: Secur0

Published:

Updated: 2026-09-25T16:54:41.750Z

Reserved: 2026-08-26T10:49:02.380Z

Link: CVE-2026-80432

cve-icon Vulnrichment

Updated: 2026-09-25T16:54:35.999Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T17:17:14.843

Modified: 2026-09-29T21:32:59.833

Link: CVE-2026-80432

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T12:15:04Z

Weaknesses