CVE-2026-95832

A flaw was found in kitty. This vulnerability allows an application writing output to the terminal to execute arbitrary commands in the user's shell. The issue occurs because the color control escape code handler echoes unrecognized field names back into the terminal's input stream without adequate sanitization. Consequently, the reflected data is processed by the shell as user input, allowing unauthorized command execution with the privileges of the active user.

This vulnerability is rated as Important because processing untrusted escape sequences can result in arbitrary command execution with the privileges of the active terminal user, requiring local interaction to display malicious data. The kitty terminal emulator is not packaged or shipped in Red Hat Enterprise Linux, and Red Hat products incorporating third-party Go ANSI helper libraries do not include the vulnerable terminal window handling code. Consequently, supported Red Hat enterprise environments are not directly affected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.