Kitty: Arbitrary Code Execution

Background

Kitty is a fast, feature-rich, GPU-based terminal.

Description

Carter Sande discovered that maliciously constructed control sequences can cause Kitty to display a notification that, when clicked, can cause Kitty to execute arbitrary commands.

Impact

Kitty can produce notifications that, when clicked, can execute arbitrary commands.

Workaround

Avoid clicking unexpected notifications.

Resolution

All Kitty users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-terms/kitty-0.26.2"