LOWVulnerability
CVE-2026-72913
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.
Properties
- epss_score
- 0.00144
- cve_id
- CVE-2026-72913
- published_at
- 2026-08-10T21:17:26.297
- last_modified
- 2026-09-09T20:55:04.493
- epss_percentile
- 0.03988
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (3)
→[Weakness]Improper Neutralization of Escape, Meta, or Control Sequences
→[Weakness]Improper Neutralization of CRLF Sequences ('CRLF Injection')
→[Weakness]Improper Neutralization of Special Elements used in a Command ('Command Injection')
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph