Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2024-23749

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-23749
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 00:55 UTC · Revision 1

Source evidence

CVE-2024-23749

core-osv · Original source

Published 9 Feb 2024, 00:00 UTC

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.

osv:CVE-2024-23749
Complete source record
{
  "id": "b0bb61dfa5163370ad3daf879a1b512ef1c4fb674de698b495e36ca8865564a6",
  "url": "https://osv.dev/vulnerability/CVE-2024-23749",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2024-23749",
    "summary": "KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.",
    "evidence": "osv:CVE-2024-23749",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2024-23749",
      "aliases": [
        "CVE-2024-23749"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/cyd01/kitty",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "75fa2abcd220c17249ff7252f8d5224137001f2d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:9bis:kitty:*:*:*:*:*:windows:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.76.1.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.76.1.13",
            "0.76.1.13",
            "v0.76.1.10",
            "0.76.1.10",
            "v0.76.1.9",
            "0.76.1.9",
            "v0.76.1.8",
            "0.76.1.8",
            "v0.76.1.7",
            "0.76.1.7",
            "v0.76.1.6",
            "0.76.1.6",
            "v0.76.1.5",
            "0.76.1.5",
            "v0.76.1.4",
            "0.76.1.4",
            "v0.76.1.3",
            "0.76.1.3",
            "v0.76.1.2",
            "0.76.1.2",
            "v0.76.0.14",
            "0.76.0.14",
            "v0.76.0.13",
            "0.76.0.13",
            "v0.76.0.12",
            "0.76.0.12",
            "v0.76.0.11",
            "0.76.0.11",
            "v0.76.0.10",
            "0.76.0.10",
            "v0.76.0.9",
            "0.76.0.9",
            "v0.76.0.8",
            "0.76.0.8",
            "v0.76.0.7",
            "0.76.0.7",
            "v0.76.0.6",
            "0.76.0.6",
            "v0.76.0.5",
            "0.76.0.5",
            "0.76.0.4",
            "v0.76.0.3",
            "0.76.0.3",
            "v0.76.0.2",
            "0.76.0.2",
            "v0.76.0.1",
            "0.76.0.1",
            "v0.74.4.13",
            "0.74.4.13",
            "v0.74.4.12",
            "0.74.4.12",
            "v0.74.4.11",
            "0.74.4.11",
            "v0.74.4.10",
            "0.74.4.10",
            "v0.74.4.9",
            "0.74.4.9",
            "v0.74.4.8",
            "0.74.4.8",
            "v0.74.4.7",
            "0.74.4.7",
            "v0.74.4.6",
            "0.74.4.6",
            "v0.74.4.5",
            "0.74.4.5",
            "v0.74.4.4",
            "0.74.4.4",
            "v0.74.4.3",
            "0.74.4.3",
            "v0.74.4.2",
            "0.74.4.2",
            "v0.74.4.1",
            "0.74.4.1",
            "v0.74.3.5",
            "0.74.3.5",
            "v0.74.3.4",
            "0.74.3.4",
            "v0.74.3.3",
            "0.74.3.3",
            "v0.74.3.2",
            "0.74.3.2",
            "v0.74.3.1",
            "0.74.3.1",
            "v0.74.2.8",
            "0.74.2.8",
            "0.74.2.7",
            "0.74.2.6",
            "0.74.2.5",
            "0.74.2.4",
            "0.74.2.3",
            "0.74.2.2",
            "0.74.2.1",
            "0.74.1.1",
            "v0.74.0.7",
            "0.74.0.7",
            "0.74.0.6",
            "0.74.0.5",
            "0.74.0.4",
            "0.74.0.3",
            "0.74.0.2",
            "0.74.0.1",
            "0.73.2.18",
            "0.73.2.17",
            "0.73.2.16",
            "0.73.2.15",
            "0.73.2.14",
            "0.73.2.13",
            "0.73.2.12",
            "0.73.2.11",
            "0.73.2.10",
            "0.73.2.9",
            "0.73.2.8",
            "0.73.2.7",
            "0.73.2.6",
            "0.73.2.5",
            "0.73.2.4",
            "0.73.2.3",
            "0.73.2.2",
            "0.73.2.1",
            "0.73.1.5",
            "0.73.1.4",
            "0.73.1.3",
            "0.73.1.2",
            "0.73.1.1",
            "0.73.0.2",
            "0.73.0.1",
            "0.72.0.6",
            "0.72.0.5",
            "0.72.0.4",
            "0.72.0.3",
            "0.72.0.2",
            "0.72.0.1",
            "0.71.0.7",
            "0.71.0.6",
            "0.71.0.5",
            "0.71.0.4",
            "0.71.0.3",
            "0.71.0.2",
            "0.71.0.1",
            "0.70.0.9"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23749.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:41.095132762Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23749.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-23749",
        "https://blog.defcesco.io/CVE-2024-23749"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23749.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-23749",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 508775,
  "published_at": "2024-02-09T00:00:00+00:00"
}