CVE-2026-54055

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54055", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T18:24:35.096Z", "datePublished": "2026-06-12T20:03:17.907Z", "dateUpdated": "2026-06-15T19:28:17.461Z"}, "containers": {"cna": {"title": "Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh"}], "affected": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"version": "< 0.47.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:03:17.907Z"}, "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue."}], "source": {"advisory": "GHSA-q446-x7q6-vcxh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T18:43:37.469547Z", "id": "CVE-2026-54055", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T19:28:17.461Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54055", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T18:24:35.096Z", "datePublished": "2026-06-12T20:03:17.907Z", "dateUpdated": "2026-06-15T19:28:17.461Z"}, "containers": {"cna": {"title": "Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh"}], "affected": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"version": "< 0.47.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:03:17.907Z"}, "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue."}], "source": {"advisory": "GHSA-q446-x7q6-vcxh", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54055", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T18:43:37.469547Z"}}}], "references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T18:44:07.956Z"}}]}}

{"affected": [{"affectedData": [{"product": "kitty", "vendor": "kovidgoyal", "versions": [{"status": "affected", "version": "< 0.47.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*", "matchCriteriaId": "5667270C-3C0A-48E0-B817-5B753E6952AC", "versionEndExcluding": "0.47.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission protocol where a child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU (Time-of-Check-Time-of-Use) race condition between symlink validation and file creation. The `os.open()` call used to create files does not use `O_NOFOLLOW`, allowing an attacker to create a symlink between the initial stat check and the actual file open, causing the write to follow the symlink to an arbitrary destination. Version 0.47.2 fixes the issue."}, {"lang": "es", "value": "Kitty es un terminal multiplataforma basado en GPU. En versiones anteriores a la 0.47.2, existe una vulnerabilidad de escalada de privilegios local en el protocolo de transmisi\u00f3n de archivos de Kitty, donde un proceso hijo ejecut\u00e1ndose en el terminal puede escribir en archivos arbitrarios en el sistema de archivos explotando una condici\u00f3n de carrera TOCTOU (Time-of-Check-Time-of-Use) entre la validaci\u00f3n de symlinks y la creaci\u00f3n de archivos. La llamada \u201cos.open()\u201d utilizada para crear archivos no utiliza \u201cO_NOFOLLOW\u201d, permitiendo a un atacante crear un symlink entre la comprobaci\u00f3n stat inicial y la apertura real del archivo, haciendo que la escritura siga el symlink a un destino arbitrario. La versi\u00f3n 0.47.2 corrige el problema."}], "id": "CVE-2026-54055", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54055", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T18:43:37.469547Z", "version": "2.0.3"}}]}, "published": "2026-06-12T20:16:47.450", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-q446-x7q6-vcxh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-426"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.47.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kitty", "source": "cna", "vendor": "kovidgoyal"}, "product": "kitty", "vendor": "kovidgoyal"}], "created": "2026-06-12T21:30:07.366426+00:00", "updated": "2026-06-12T21:30:07.685446+00:00", "vendors": ["kovidgoyal", "kovidgoyal$PRODUCT$kitty"]}