DEBIAN-CVE-2026-54056
Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.
DEBIAN-CVE-2026-54056
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-54056
kitty
Source reference: /affected/0/package/name
- Affected versions
- 0.41.1-2
Source reference:
/affected/0/versions0.42.1-1Source reference:
/affected/0/versions0.42.2-1Source reference:
/affected/0/versions0.43.1-1Source reference:
/affected/0/versions0.44.0-1Source reference:
/affected/0/versions0.45.0-1Source reference:
/affected/0/versions0.45.0-2Source reference:
/affected/0/versions0.46.1-1Source reference:
/affected/0/versions0.46.2-1Source reference:
/affected/0/versions0.47.0-1Source reference:
/affected/0/versions0.47.0-2Source reference:
/affected/0/versions0.47.0-3Source reference:
/affected/0/versions - Fixed versions
- 0.47.3-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.47.3-1"
}
]
}
],
"package": {
"name": "kitty",
"purl": "pkg:deb/debian/kitty?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.41.1-2",
"0.42.1-1",
"0.42.2-1",
"0.43.1-1",
"0.44.0-1",
"0.45.0-1",
"0.45.0-2",
"0.46.1-1",
"0.46.2-1",
"0.47.0-1",
"0.47.0-2",
"0.47.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54056.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57785 · Revision 1
- Added to Heist Feed
- Publisher date