CVE-2026-72913

This vulnerability exposes a fundamental design flaw in Kitty's DCS (Device Control String) handlers: the boundary between displaying content and executing shell commands has been architecturally blurred. The @kitty-echo handler accepts printable shell command characters and writes them directly to stdin, while @kitty-ssh provides a trailing newline through a different code path. By composing these two legitimate features in sequence—attacker-controlled content via echo, followed by any SSH data that carries a newline—arbitrary commands execute without requiring traditional exploits like buffer overflows or format strings. The critical detail is that this executes passively: simply displaying untrusted terminal content triggers execution, not clicking a link or approving an action. Upgrade to Kitty 0.48.2 immediately. Beyond patching, audit your terminal environment for other DCS handlers that write to stdin—these represent potential edges in an attack graph that hasn't been systematically mapped. The passive execution vector shifts the threat model for any workflow involving untrusted terminal content: SSH to new servers, terminal-based chat, rendered logs, or shared configuration output. The CVSS 3.1 score of 7.3 reflects the individual impact, but the cascading trust failure is larger—the terminal ecosystem has operated on an unvalidated assumption that displaying text is safe, and this CVE demonstrates that assumption can be structurally broken through feature composition rather than traditional vulnerability hunting.

Reviewed through automated stages and approved by a human before publication.