CVE-2022-41322

Katalog CVE

CVSS 7.8 · High EPSS 0,54%

Kerentanan Improper Encoding or Escaping of Output pada kitty project kitty, fedoraproject fedora. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.

Rincian

Terbit di NVD

23 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://sw.kovidgoyal.net/kitty/changelog/#detailed-list-of-changes release notes · advisory vendor
• https://bugs.gentoo.org/868543 exploit · issue tracking · patch · advisory pihak ketiga
• https://github.com/kovidgoyal/kitty/commit/f05783e64d5fa62e1aed603e8d69aced5e49824f patch
• https://github.com/kovidgoyal/kitty/compare/v0.26.1...v0.26.2 patch
• https://security.gentoo.org/glsa/202209-22 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47RK7MBSVY5BW...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RRNAPU33PHEH...
• https://lists.debian.org/debian-lts-announce/2025/06/msg00000.html