CVE-2025-43929CWE-346

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted…

Medium · published April 20, 2025

CVSS v3.1
4.1
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2025-04-20T00:00Z
EPSS history
Timeline
  • 20 APR 00:00Z
    open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted…
    cvelistv5