The vulnerability resides in the colour control escape code parser in the kitty terminal emulator. When an unknown field name is requested, kitty reflects that field name into its reply without proper sanitisation. The reply is then written to the pseudoterminal master, appearing as user input. Because the shell reads this input, an attacker can craft a field name that contains shell syntax, resulting in the execution of an arbitrary command with the privileges of the terminal user. The weakness is an instance of Improper Neutralisation of Special Elements in Output, a variant of injection, which is identified as CWE‑74 and CWE‑78.

The affected product is kitty by Kovid Goyal, versions from 0.47.3 up to but not including 0.49.0. This includes all builds of kitty released in that range that ship the colour control escape code logic in window.py and screen.c.

With a CVSS score of 9.3, the vulnerability is considered critical. The EPSS score is less than 1%, indicating a very low exploitation probability, and the issue has not been listed in the CISA KEV catalog, suggesting limited known exploitation. However, the attack vector requires a program with write access to the terminal’s pseudoterminal master – a condition that can be satisfied by local applications, potentially including malicious or compromised software. Once triggered, it leads to full command execution in the context of the terminal user, granting the attacker complete control over that user’s session.