Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
kovidgoyal kitty — Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N R U N H L 7.1 .0027 19.1 —
AFFECTED
Product Versions Fixed
kitty >= 0.47.0, < 0.47.2 – —
TIMELINE
Jun 11 Reserved by GitHub_M
Jun 12 EXPLOIT PUBLISHED — CVE-2026-54056 (kovidgoyal kitty). Public exploit reference added.
Jun 12 Published (CNA: GitHub_M)
Description
Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 11, 2026 | Reserved | Reserved by GitHub_M |
| June 12, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-54056 (kovidgoyal kitty). Public exploit reference added. |
| June 12, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| kovidgoyal | kitty | — | >= 0.47.0, < 0.47.2 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-54056 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.