CVE-2026-54057

Katalog CVE

CVSS 7.8 · High EPSS 0,17%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada kovidgoyal kitty. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-5gmr-9gwg-hhq6 exploit · advisory vendor