CVE-2026-54057CWE-150CWE-94

Kitty vulnerable to command injection via unsanitized OSC 21 query reply

High · published June 12, 2026

CVSS v4.0
7.3
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00172 · 6.3th percentile
Weaknesses
CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-06-12T20:07Z
EPSS history
Timeline
  • 12 JUN 20:07Z
    Kitty vulnerable to command injection via unsanitized OSC 21 query reply
    cvelistv5