CVE-2026-54056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54056", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T18:24:35.096Z", "datePublished": "2026-06-12T20:06:06.437Z", "dateUpdated": "2026-06-15T13:03:10.902Z"}, "containers": {"cna": {"title": "Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x"}], "affected": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"version": ">= 0.47.0, < 0.47.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:06:06.437Z"}, "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue."}], "source": {"advisory": "GHSA-r892-cv7q-fw8x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-15T13:02:47.195998Z", "id": "CVE-2026-54056", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T13:03:10.902Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54056", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T13:02:47.195998Z"}}}], "references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-15T13:03:06.274Z"}}], "cna": {"title": "Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging", "source": {"advisory": "GHSA-r892-cv7q-fw8x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"status": "affected", "version": ">= 0.47.0, < 0.47.2"}]}], "references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x", "name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T20:06:06.437Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54056", "state": "PUBLISHED", "dateUpdated": "2026-06-15T13:03:10.902Z", "dateReserved": "2026-06-11T18:24:35.096Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T20:06:06.437Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kitty", "vendor": "kovidgoyal", "versions": [{"status": "affected", "version": ">= 0.47.0, < 0.47.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*", "matchCriteriaId": "E68DF582-51E7-4585-9070-2CA8F562D842", "versionEndExcluding": "0.47.2", "versionStartIncluding": "0.47.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue."}, {"lang": "es", "value": "Kitty es una terminal multiplataforma basada en GPU. En las versiones 0.47.0 y 0.47.1, \u201ckitten dnd\u201d puede permitir que un origen malicioso remoto de arrastrar y soltar sobrescriba o trunque archivos arbitrarios escribibles por el usuario local de kitty. Los elementos remotos soltados de \u201ctext/uri-list\u201d se almacenan provisionalmente en un directorio temporal, pero en sistemas de archivos que distinguen entre may\u00fasculas y min\u00fasculas, los nombres base remotos duplicados no se desduplican. Un atacante puede primero crear un enlace simb\u00f3lico provisional y luego enviar una entrada de archivo regular con el mismo nombre. La escritura del archivo regular utiliza \u201cutils.CreateAt()\u201d / \u201copenat(O_RDWR|O_CREAT|O_TRUNC)\u201d sin \u201cO_NOFOLLOW\u201d, por lo que sigue el enlace simb\u00f3lico creado por el atacante y escribe fuera del directorio provisional antes de que se ejecute la confirmaci\u00f3n final de sobrescritura. Esto parece relacionado en su tipo con el aviso de enlace simb\u00f3lico de transferencia de archivos, pero es un error diferente: afecta a la preparaci\u00f3n remota de arrastrar y soltar de \u201ckitten dnd\u201d, utiliza c\u00f3digo vulnerable diferente (\u201ckittens/dnd/drop.go\u201d y \u201ctools/utils/file_at_fd.go\u201d), y se reproduce en el commit \u201c4aa4a5c0567a92553a8c20a88a4352da637fca5d\u201d, despu\u00e9s de la correcci\u00f3n de \u201cO_NOFOLLOW\u201d para la transferencia de archivos. La versi\u00f3n 0.47.2 soluciona el problema."}], "id": "CVE-2026-54056", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54056", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-15T13:02:47.195998Z", "version": "2.0.3"}}]}, "published": "2026-06-12T21:16:24.463", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.47.0,0.47.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kitty", "source": "cna", "vendor": "kovidgoyal"}, "product": "kitty", "vendor": "kovidgoyal"}], "created": "2026-06-12T22:45:28.850376+00:00", "updated": "2026-06-12T23:15:10.181944+00:00", "vendors": ["kovidgoyal", "kovidgoyal$PRODUCT$kitty"]}