Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-54056

Type: advisorySource: OSV1 source record

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-54056

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-54056

kitty

Source reference: /affected/0/package/name

Affected versions
0.41.1-2

Source reference: /affected/0/versions

0.42.1-1

Source reference: /affected/0/versions

0.42.2-1

Source reference: /affected/0/versions

0.43.1-1

Source reference: /affected/0/versions

0.44.0-1

Source reference: /affected/0/versions

0.45.0-1

Source reference: /affected/0/versions

0.45.0-2

Source reference: /affected/0/versions

0.46.1-1

Source reference: /affected/0/versions

0.46.2-1

Source reference: /affected/0/versions

0.47.0-1

Source reference: /affected/0/versions

0.47.0-2

Source reference: /affected/0/versions

0.47.0-3

Source reference: /affected/0/versions

Fixed versions
0.47.3-1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.47.3-1"
          }
        ]
      }
    ],
    "package": {
      "name": "kitty",
      "purl": "pkg:deb/debian/kitty?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "0.41.1-2",
      "0.42.1-1",
      "0.42.2-1",
      "0.43.1-1",
      "0.44.0-1",
      "0.45.0-1",
      "0.45.0-2",
      "0.46.1-1",
      "0.46.2-1",
      "0.47.0-1",
      "0.47.0-2",
      "0.47.0-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54056.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#57785 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement