CVE-2026-95832Published
Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-95832 · Microsoft / collected KEV context
cve-program · CVE-2026-95832
- https://github.com/kovidgoyal/kitty/commit/03fbdad855490470233954bc810e517027e5e640
- https://github.com/kovidgoyal/kitty/commit/57bb144d96c0f9d48a2b0a6d43c9a23d2a091cbf
- https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0
- https://www.cve.org/CVERecord?id=CVE-2026-54057
- https://secur0.com/en/cna/cve-list/cve-2026-95832-kitty-color-control-command-execution
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.