CVE-2026-72913

A flaw was found in Kitty, a cross-platform GPU based terminal. This vulnerability allows an attacker to achieve arbitrary code execution by chaining specific escape sequences (@kitty-echo and @kitty-ssh) when a user displays untrusted terminal data. These sequences write unauthenticated data to the child shell's input, enabling the execution of attacker-controlled commands. This could lead to a complete compromise of the user's system.

Red Hat has rated this vulnerability as Important because successful exploitation allows arbitrary command execution in the context of the active user, carrying high confidentiality, integrity, and availability impacts. While the flaw can yield full compromise of the user's shell environment, it requires user interaction to process untrusted or maliciously crafted escape sequences rather than permitting direct unauthenticated remote execution. Additionally, Kitty is not included in default Red Hat Enterprise Linux installations, restricting exposure to environments where this terminal emulator has been explicitly deployed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.