Command injection

2024-02-0908:15:00

PRIOn knowledge base

www.prio-n.com

kitty

command injection

vulnerability

input sanitization

validation

special characters

insecure system calls

arbitrary code execution

8.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

24.0%

JSON

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.