DEBIAN-CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72913

CVE-2026-72913 affects Kitty terminal (GPU-based, cross-platform) prior to version 0.48.2. The vulnerability arises from misbehavior in the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py, which write unauthenticated data to the child shell’s stdin. The handle_remote_echo path accepts ...

CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

PT-2026-69981

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.48.2 Description In the kitty/window.py file, the @kitty-echo and @kitty-ssh DCS handlers write unauthenticated data to the child shell's stdin. The handle remote echo function accepts printable shell command...