kitty - Debian Package Tracker

general

source: kitty (main)
version: 0.48.2-1
maintainer: Nilesh Patra (DMD)
uploaders: Maytham Alsudany [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.19.3-1
o-o-sec: 0.19.3-1+deb11u1
oldstable: 0.26.5-5
stable: 0.41.1-2+deb13u1
stable-sec: 0.41.1-2+deb13u2
testing: 0.48.2-1
unstable: 0.48.2-1

versioned links

0.19.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.19.3-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.26.5-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.41.1-2+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.41.1-2+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.48.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

kitty (1 bugs: 0, 0, 1, 0)
kitty-doc (1 bugs: 0, 0, 1, 0)
kitty-shell-integration
kitty-terminfo

action needed

Marked for autoremoval on 14 September due to fish: #1143304 high

Version 0.48.2-1 of kitty is marked for autoremoval from testing on Mon 14 Sep 2026. It depends (transitively) on fish, affected by #1143304. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-08-08 Last update: 2026-08-13 10:01

6 security issues in bullseye high

There are 6 open security issues in bullseye.

6 important issues:

CVE-2026-33633: Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
CVE-2026-42850: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.
CVE-2026-42851: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
CVE-2026-54055: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
CVE-2026-54057: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
CVE-2026-72913: Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Created: 2026-05-22 Last update: 2026-08-11 12:18

8 security issues in bookworm high

There are 8 open security issues in bookworm.

7 important issues:

CVE-2026-33633: Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
CVE-2026-33642: Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.
CVE-2026-42850: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.
CVE-2026-42851: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.
CVE-2026-54055: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.
CVE-2026-54057: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
CVE-2026-72913: Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

1 issue postponed or untriaged:

CVE-2025-43929: (needs triaging) open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

Created: 2025-04-20 Last update: 2026-08-11 12:18

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-72913: Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Created: 2026-08-11 Last update: 2026-08-11 12:18

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-05-26 Last update: 2026-08-13 04:00

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit cb03fa371becfb7f2358ee613811ab67fe43d6c8
Author: Nilesh Patra <nilesh@debian.org>
Date:   Thu Aug 13 00:23:31 2026 +0530

    d/salsa-ci.yml: Explicitly disable autopkgtests

https://salsa.debian.org/api/v4/projects/debian%2Fkitty API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-12 Last update: 2026-08-12 20:01

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-02 Last update: 2026-08-02 17:49

AppStream hints: 1 warning normal

AppStream found metadata issues for packages:

kitty: 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2020-06-01 Last update: 2020-06-01 01:13

debian/patches: 6 patches to forward upstream low

Among the 15 debian patches available in version 0.48.2-1 of the package, we noticed the following issues:

6 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-08-02 13:30

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-08-09] Accepted kitty 0.41.1-2+deb13u2 (source) into stable-security (Debian FTP Masters) (signed by: Aron Xu)
[2026-08-08] kitty 0.48.2-1 MIGRATED to testing (Debian testing watch)
[2026-08-02] Accepted kitty 0.48.2-1 (source) into unstable (Nilesh Patra)
[2026-07-14] kitty 0.47.4-1 MIGRATED to testing (Debian testing watch)
[2026-06-21] Accepted kitty 0.47.4-1 (source) into unstable (Maytham Alsudany)
[2026-06-20] kitty 0.47.3-1 MIGRATED to testing (Debian testing watch)
[2026-06-13] Accepted kitty 0.47.3-1 (source) into unstable (Nilesh Patra)
[2026-05-28] Accepted kitty 0.41.1-2+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Nilesh Patra)
[2026-05-28] Accepted kitty 0.41.1-2+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Nilesh Patra)
[2026-05-26] kitty 0.47.0-3 MIGRATED to testing (Debian testing watch)
[2026-05-22] Accepted kitty 0.47.0-3 (source) into unstable (Nilesh Patra)
[2026-05-21] Accepted kitty 0.47.0-2 (source) into unstable (Nilesh Patra)
[2026-05-21] Accepted kitty 0.47.0-1 (source) into unstable (Nilesh Patra)
[2026-05-09] kitty 0.46.2-1 MIGRATED to testing (Debian testing watch)
[2026-04-30] Accepted kitty 0.46.2-1 (source) into unstable (Maytham Alsudany)
[2026-03-22] kitty 0.46.1-1 MIGRATED to testing (Debian testing watch)
[2026-03-17] Accepted kitty 0.46.1-1 (source) into unstable (Nilesh Patra)
[2026-02-28] kitty 0.45.0-2 MIGRATED to testing (Debian testing watch)
[2026-02-22] Accepted kitty 0.45.0-2 (source) into unstable (Nilesh Patra)
[2026-01-08] kitty 0.45.0-1 MIGRATED to testing (Debian testing watch)
[2026-01-02] Accepted kitty 0.45.0-1 (source) into unstable (Nilesh Patra)
[2025-12-02] kitty 0.44.0-1 MIGRATED to testing (Debian testing watch)
[2025-11-26] Accepted kitty 0.44.0-1 (source) into unstable (Nilesh Patra)
[2025-10-24] kitty 0.43.1-1 MIGRATED to testing (Debian testing watch)
[2025-10-18] Accepted kitty 0.43.1-1 (source) into unstable (Nilesh Patra)
[2025-10-04] kitty 0.42.2-1 MIGRATED to testing (Debian testing watch)
[2025-09-27] Accepted kitty 0.42.2-1 (source) into unstable (Nilesh Patra)
[2025-07-15] Accepted kitty 0.42.1-1 (source) into experimental (Maytham Alsudany)
[2025-06-11] kitty 0.41.1-2 MIGRATED to testing (Debian testing watch)
[2025-06-05] Accepted kitty 0.41.1-2 (source) into unstable (Nilesh Patra)

bugs [bug history graph]

all: 2
RC: 0
I&N: 0
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.47.4-1