CVE-2026-72913

CVE-2026-72913 affects Kitty terminal (GPU-based, cross-platform) prior to version 0.48.2. The vulnerability arises from misbehavior in the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py, which write unauthenticated data to the child shell’s stdin. The handle_remote_echo path accepts ...