Debian Security Advisory DSA-6423-1 security@debian.org https://www.debian.org/security/ Nilesh Patra August 09, 2026 https://www.debian.org/security/faq

Package : kitty CVE ID : CVE-2026-42850 CVE-2026-42851 CVE-2026-54055 CVE-2026-54057 Debian Bug : 1139898

Multiple security issues were discovered in kitty, a GPU based terminal emulator, which may result in the execution of arbitrary code, command injection into the shell running in the terminal, or the overwriting of arbitrary files, if untrusted content is displayed in a terminal window.

For the stable distribution (trixie), these problems have been fixed in version 0.41.1-2+deb13u2.

We recommend that you upgrade your kitty packages.

For the detailed security status of kitty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/kitty

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmp4qsMACgkQ+GQ1dHE8 m67U4QgAmKCD2N21YxqxSGQEeLGbKbGUySdk+XKgAvnA7sZqDL2spmSczGP+dJiC ZKTFLTKm3AsnoOOa4C1lQayYfwJTSKkmDaI1lPys2flV5TA+Ay0fkiHvAJsbXwIM u1/UYtx9vlOIlGqtW9fwdfhwrYunukXuz/m76Svt7HuEoSnrebxe7TX8dAZW9Stj gvOKNl4+Z6Bj4PMdFNfPyzhM55RAPQX9ZBN/E2JA8Gfsxx61AN1DgFa/+zyNstrr 06tJfarXTO57vEWws5L7fm9J/1BBMkz6nQgJkNC/SLlaxzKuYycsA6ncx/F8N8Jr vd8Pf9VoGKjltYmnESjKWrPjCnum5Q== =mScO -----END PGP SIGNATURE-----