The Kitty terminal emulator is vulnerable to command injection via specially crafted escape codes, which could allow an attacker to execute arbitrary commands in the user's subshell.

The vulnerability exists because Kitty incorrectly processes specific escape codes that result in an unescaped error. This unescaped output is subsequently interpreted and executed by the user's shell, enabling local command injection.

With a CVSS score of 8.8, this flaw allows an attacker to execute commands with the privileges of the user running the terminal. This could lead to a full local system compromise, installation of persistent backdoors, or theft of sensitive files, particularly if the terminal is used by administrative or privileged users.

Immediate Action: Upgrade the Kitty terminal emulator to version 0.47.0 or later to patch the escape code handling logic.

Proactive Monitoring: Monitor system logs for unexpected shell process spawning or anomalous command execution originating from the terminal emulator process.

Compensating Controls: Avoid printing untrusted output or files directly to the terminal, especially when the source of the data is unknown or potentially malicious.

Public Exploit Available: false

This is a significant security flaw for terminal users. Because command injection can lead to immediate system compromise, all users should update their installation to version 0.47.0 immediately to mitigate the risk of malicious escape sequence exploitation.