CVE-2026-54055

The record

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
• CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
• CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59
• CVE-2026-105081 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for… CWE-59
• CVE-2026-108119 A flaw was found in busybox. CWE-59
• CVE-2026-12345 The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. CWE-59