A critical command injection vulnerability in the kitty terminal emulator allows attackers to execute arbitrary code on the host system with the privileges of the user running the terminal.

The vulnerability exists in the color_control() function within kitty/window.py, where unrecognized field names in terminal escape codes are echoed back to the pseudoterminal master without sufficient neutralization. Because the terminal treats this echoed output as user input, an attacker can craft specific sequences that result in arbitrary command execution in the user's shell.

Successful exploitation allows an attacker to gain full control over the user's terminal session, leading to potential unauthorized access to local files, sensitive data theft, and further compromise of the underlying system. Given the CVSS score of 9.3, this flaw poses a severe risk to any environment where kitty is used to process untrusted output, such as viewing logs or remote server banners.

Immediate Action: Upgrade to kitty version 0.49.0 or later immediately to apply the required input neutralization patches.

Proactive Monitoring: Monitor terminal usage patterns for unexpected command execution or anomalous child processes spawned from the terminal emulator process.

Compensating Controls: Avoid opening untrusted files, logs, or connecting to untrusted SSH hosts within the kitty terminal until the update is applied, as these actions can trigger the vulnerability.

Public Exploit Available: Yes, a working exploit is documented in the technical write-up provided by Secur0.

This vulnerability represents a critical security risk due to the ease of exploitation and the high level of impact on the host system. All users of the affected versions must prioritize upgrading to version 0.49.0, which resolves the issue by encoding unrecognized fields and restricting the character set to prevent command construction. Failure to patch leaves the system exposed to trivial command injection attacks via standard terminal interactions.