CVE-2026-95835

The kitty terminal emulator (versions 0.25.0 before 0.49.0 ) contains a missing authorization vulnerability in its askpass escape code handler. The root cause is located in handle_remote_askpass() within kitty/window.py, which opens a POSIX shared memory object but fails to verify if the object i...

CVE-2026-95835

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...