CVE-2026-95835 Kitty Terminal Emulator Shared Memory Vulnerability – Analysis & Mitigation

Executive Summary

CVE-2026-95835 is a local privilege escalation vulnerability affecting the kitty terminal emulator versions 0.25.0 through 0.48.x. The flaw exists in the handle_remote_askpass() function, which fails to properly validate ownership and permissions of POSIX shared memory objects. This oversight allows local, unprivileged users to intercept sensitive information—including passwords and authentication credentials—typed into terminal prompts without the knowledge or consent of the terminal owner.

The vulnerability is particularly concerning in multi-user systems, shared hosting environments, and containerized deployments where multiple users may have access to the same physical or logical system. An attacker requires only local system access and basic knowledge of shared memory manipulation to exploit this flaw.

Severity Level: High
CVSS Estimated Score: 7.1 (High)
Affected Versions: 0.25.0 – 0.48.x
Fixed Version: 0.49.0 and later

Vulnerability Overview

What is CVE-2026-95835?

CVE-2026-95835 is a credential disclosure vulnerability in the kitty terminal emulator that stems from inadequate authorization checks when handling POSIX shared memory objects. The vulnerability allows a local attacker to:

• Create malicious shared memory objects that kitty instances will access
• Manipulate prompt text displayed to legitimate users
• Capture sensitive input (passwords, API keys, tokens) from shared memory
• Bypass authentication mechanisms without elevated privileges

The root cause is the absence of ownership verification in the handle_remote_askpass() function, which processes escape codes for password prompts. When kitty receives an askpass escape code, it opens a shared memory object without confirming that the object’s owner is the legitimate terminal session owner.

Affected Versions and Products

Product: Kitty Terminal Emulator
Vendor: Kovid Goyal
Affected Versions: 0.25.0 through 0.48.x (inclusive)
Fixed Version: 0.49.0 and later

Kitty is a modern, GPU-accelerated terminal emulator written in C and Python, popular among developers, system administrators, and power users for its performance and extensibility. The vulnerability affects all installations of vulnerable versions across Linux, macOS, and other Unix-like systems.

Why This Matters for Your Infrastructure

Terminal emulators are critical components in system administration workflows. Users frequently enter sensitive information through terminal prompts, including:

• SSH passphrases and private key passwords
• Database credentials
• API authentication tokens
• Cloud provider access keys
• Sudo passwords and system authentication

In multi-user environments—including shared servers, development clusters, and containerized systems—this vulnerability creates a direct pathway for credential theft. An attacker with local system access can silently capture credentials without triggering traditional security alerts or requiring administrative privileges.

The vulnerability is particularly dangerous because:

1. Silent exploitation: No visible indicators alert users to credential capture
2. Widespread applicability: Affects any system where kitty is used with sensitive operations
3. Low barrier to entry: Requires only basic knowledge of POSIX shared memory
4. Persistent risk: Vulnerable versions remain in use across many organizations

Technical Breakdown

Root Cause: Unsafe Shared Memory Handling

The vulnerability originates from a fundamental design flaw in how kitty handles remote askpass functionality. POSIX shared memory objects (/dev/shm on Linux systems) are intended for inter-process communication but lack built-in access control mechanisms beyond standard file permissions.

Kitty’s implementation fails to verify that a shared memory object requesting access is owned by the legitimate terminal session. This is analogous to a file operation that opens any file without checking ownership—a critical security oversight.

Vulnerable Code Pattern:

// Pseudocode representation of vulnerable logic
function handle_remote_askpass(escape_code):
    shm_name = extract_shm_name(escape_code)
    shm_fd = shm_open(shm_name, O_RDWR)  // No ownership check
    prompt_data = read(shm_fd)
    display_prompt(prompt_data)
    user_input = capture_input()
    write(shm_fd, user_input)  // Attacker reads from shared memory

The handleremoteaskpass() Function Flaw

The handle_remote_askpass() function in kitty/window.py processes escape codes that instruct kitty to display password prompts. The function’s intended purpose is to support remote SSH sessions and other scenarios where password input is needed.

Vulnerable Implementation Issues:

1. No ownership verification: The function calls shm_open() without checking if the shared memory object is owned by the current user or session
2. Missing permission validation: File-level permissions on shared memory objects are not verified before access
3. Unvalidated prompt source: The prompt text itself comes from the shared memory object, allowing attackers to display arbitrary text
4. Bidirectional access: The function both reads prompts from and writes user input to the same shared memory object

How Authorization Checks Are Bypassed

An attacker exploits this vulnerability through the following sequence:

1. Reconnaissance: Identify that the target system runs a vulnerable kitty version
2. Object creation: Create a POSIX shared memory object with a predictable or guessable name
3. Prompt injection: Craft an escape code that references the attacker-controlled shared memory object
4. Delivery: Inject the malicious escape code into the victim’s terminal (via compromised shell script, malicious output, or other means)
5. Capture: Read the victim’s input from the shared memory object after they interact with the prompt

The bypass is possible because kitty trusts the escape code source implicitly. If an attacker can inject escape codes into the terminal stream—which is possible through various attack vectors—kitty will process them without additional authorization checks.

Attack Surface in Multi-User Environments

Multi-user systems present the largest attack surface:

• Shared /dev/shm: All users on the system can create and access shared memory objects with appropriate permissions
• Process isolation: Kitty instances running under different user accounts cannot be isolated from each other’s shared memory access
• Container environments: Containerized deployments with multiple users in the same container are particularly vulnerable
• Privilege escalation chains: An attacker with limited privileges can capture credentials from higher-privileged users

Attack Scenarios and Real-World Impact

Local User Exploitation Method

Scenario: A development team shares a Linux server for collaborative work. User A (attacker) and User B (victim) both have local accounts.

Attack Steps:

1. User A monitors the system for kitty instances: ps aux | grep kitty
2. User A creates a shared memory object: shm_open("/dev/shm/malicious_askpass", O_CREAT | O_RDWR)
3. User A injects an escape code into a file that User B will execute (e.g., a shell script in a shared directory)
4. When User B executes the script, kitty processes the malicious escape code
5. Kitty displays a prompt from the attacker-controlled shared memory
6. User B enters their password, thinking it’s a legitimate system prompt
7. User A reads the password from the shared memory object

Time to exploitation: Less than 5 minutes with basic shell knowledge

Prompt Manipulation Tactics

Attackers can craft prompts that appear legitimate to users:

Enter SSH passphrase for id_rsa:

Sudo password required:

Enter database password:

These prompts are indistinguishable from legitimate system prompts, making social engineering unnecessary. Users naturally comply with password requests in terminal environments.

Credential Capture Mechanics

Once a user enters credentials in response to a manipulated prompt, the data flows directly into the attacker-controlled shared memory object:

1. Input capture: Kitty reads user keystrokes character-by-character
2. Shared memory write: Each character is written to the shared memory object
3. Attacker retrieval: The attacker reads the complete credential string from shared memory
4. No logging: The capture leaves minimal forensic evidence in standard system logs

The attacker can also manipulate the prompt to hide user input (masked password entry), making the attack completely invisible to the user.

Risk Assessment for Your Organization

High-Risk Environments:

• Multi-user development servers
• Shared hosting platforms
• Containerized deployments with multiple users
• CI/CD systems where multiple teams have access
• Research computing clusters
• Educational institutions with shared lab systems

Credential Types at Risk:

• SSH private key passphrases
• Database passwords
• Cloud provider credentials (AWS, Azure, GCP)
• API tokens and authentication keys
• Sudo passwords
• VPN credentials
• Git repository credentials

Business Impact:

• Unauthorized access to production systems
• Data breach through compromised credentials
• Lateral movement within infrastructure
• Compliance violations (HIPAA, PCI-DSS, SOC 2)
• Reputational damage

Detection and Monitoring

Identifying Affected Systems

Inventory Check:

# Check kitty version on systems
kitty --version
# Find all kitty installations
which kitty
find /usr -name "kitty" -type f 2>/dev/null

Automated Detection Script:

#!/bin/bash
# Identify vulnerable kitty installations
KITTY_PATH=$(which kitty 2>/dev/null)
if [ -z "$KITTY_PATH" ]; then
    echo "Kitty not found"
    exit 0
fi
VERSION=$($KITTY_PATH --version | awk '{print $2}')
MAJOR=$(echo $VERSION | cut -d. -f1)
MINOR=$(echo $VERSION | cut -d. -f2)
PATCH=$(echo $VERSION | cut -d. -f3)
# Check if version is between 0.25.0 and 0.48.x
if [ "$MAJOR" -eq 0 ] && [ "$MINOR" -ge 25 ] && [ "$MINOR" -lt 49 ]; then
    echo "VULNERABLE: Kitty $VERSION is affected by CVE-2026-95835"
else
    echo "OK: Kitty $VERSION is not affected"
fi

Enterprise Scanning:

• Use configuration management tools (Ansible, Puppet, Chef) to audit all systems
• Query package managers: rpm -qa | grep kitty or dpkg -l | grep kitty
• Scan container images for vulnerable kitty versions

Log Analysis Techniques

System Call Monitoring:

Monitor for suspicious shared memory operations:

# Using auditd to track shm_open calls
auditctl -a always,exit -F arch=b64 -S shm_open -k shm_access
# Review audit logs
ausearch -k shm_access

Shared Memory Access Patterns:

Look for:

• Unexpected shm_open() calls from non-standard processes
• Multiple processes accessing the same shared memory object
• Shared memory objects created with overly permissive access (mode 0666)
• Rapid creation and deletion of shared memory objects

Process Monitoring:

# Monitor for suspicious kitty escape code injection
# Look for processes writing to /dev/pts/* with escape sequences
strace -e write -p <kitty_pid> 2>&1 | grep -E "\\\\x1b|\\[|OSC"

Shared Memory Access Monitoring

Real-time Monitoring:

# Monitor /dev/shm for suspicious activity
watch -n 1 'ls -la /dev/shm/ | grep -E "askpass|kitty"'
# Track shared memory object creation
inotifywait -m -e create /dev/shm/

Forensic Analysis:

# List all shared memory objects
ipcs -m
# Check permissions on shared memory objects
ls -la /dev/shm/
# Identify owner of shared memory objects
stat /dev/shm/<object_name>

Red Flags in User Activity

Suspicious Indicators:

1. Unexpected password prompts: Users reporting unusual password requests
2. Credential reuse patterns: Multiple failed login attempts with same credentials
3. Shared memory anomalies: Unexpected objects in /dev/shm with unusual names
4. Process relationships: Kitty instances spawned by unexpected parent processes
5. Timing correlations: Password prompt events followed immediately by authentication failures elsewhere
6. Cross-user access: One user’s kitty instance accessed by another user’s processes

Detection Queries:

# Find all shared memory objects created in last hour
find /dev/shm -type f -mmin -60
# Identify processes with unusual shared memory access
lsof | grep shm
# Check for escape code injection attempts in logs
grep -r "\\\\x1b\\[" /var/log/ 2>/dev/null

Remediation and Mitigation

Immediate Upgrade Path to 0.49.0+

Priority: Critical – Execute within 24-48 hours

Upgrade Methods:

Linux (Package Manager):

# Debian/Ubuntu
sudo apt update
sudo apt install --only-upgrade kitty
# RHEL/CentOS/Fedora
sudo yum update kitty
# or
sudo dnf upgrade kitty
# Arch Linux
sudo pacman -S kitty

macOS (Homebrew):

brew upgrade kitty

From Source:

git clone https://github.com/kovidgoyal/kitty.git
cd kitty
git checkout v0.49.0
python3 setup.py build
sudo python3 setup.py install

Verification:

kitty --version
# Should output: kitty 0.49.0 or later

Deployment Strategy:

1. Test in non-production: Verify 0.49.0 compatibility with your workflows
2. Staged rollout: Update development systems first, then staging, then production
3. User communication: Notify users of the upgrade and any potential workflow changes
4. Rollback plan: Maintain previous version availability for 48 hours post-upgrade
5. Verification: Confirm all systems have upgraded successfully

Temporary Mitigations for Delayed Patching

If immediate upgrade is not possible, implement these controls:

Access Restrictions:

# Restrict kitty to specific users only
sudo usermod -a -G kitty_users <username>
sudo chmod 750 /usr/bin/kitty
# Disable remote askpass functionality (if possible)
# Add to ~/.config/kitty/kitty.conf:
# allow_remote_control no

Shared Memory Hardening:

# Restrict /dev/shm permissions
sudo mount -o remount,noexec,nosuid,nodev /dev/shm
# Set umask to prevent world-readable shared memory
umask 0077

Process Isolation:

# Use AppArmor or SELinux to restrict kitty's shared memory access
# Example AppArmor profile:
/usr/bin/kitty {
  # ... other rules ...
  deny /dev/shm/** rw,
}

User Separation:

• Isolate users in separate containers or virtual machines
• Implement strict access controls on shared systems
• Use separate kitty instances for different privilege levels

Access Control Strategies

Multi-User System Hardening:

1. Principle of Least Privilege: Run kitty with minimal necessary permissions
2. User Isolation: Separate user accounts for different functions
3. Group-based Access: Use Unix groups to control kitty access
4. SELinux/AppArmor: Implement mandatory access controls

Configuration Hardening:

# ~/.config/kitty/kitty.conf
# Disable potentially dangerous features
allow_remote_control no
listen_on none
# Restrict escape code processing
# (Check kitty documentation for available options)

Monitoring and Alerting:

# Alert on suspicious shared memory access
# Using osquery or similar EDR tools
SELECT * FROM process_open_sockets 
WHERE remote_address LIKE '/dev/shm%';

Ongoing Security Monitoring

Post-Remediation Verification:

1. Confirm upgrades: Verify all systems running 0.49.0+
2. Audit logs: Review logs for exploitation attempts during vulnerable period
3. Credential rotation: Rotate any credentials that may have been exposed
4. Access review: Audit who accessed sensitive systems during vulnerability window

Continuous Monitoring:

# Regular version checks
0 2 * * * /usr/local/bin/check_kitty_version.sh | mail -s "Kitty Version Report" admin@example.com
# Monitor for new vulnerabilities
# Subscribe to: https://github.com/kovidgoyal/kitty/security/advisories

Prevention Best Practices

Secure Terminal Configuration

Kitty Configuration Hardening:

# ~/.config/kitty/kitty.conf
# Disable remote control features
allow_remote_control no
listen_on none
# Restrict escape code processing
# Only allow safe escape codes
enable_audio_bell no
# Disable potentially dangerous features
shell_integration disabled
# Use secure defaults
update_check_interval 0

Shell Configuration:

# ~/.bashrc or ~/.zshrc
# Disable command history in sensitive sessions
set +o history
# Warn on suspicious terminal activity
trap 'echo "WARNING: Unexpected command execution"' DEBUG

Multi-User Environment Hardening

System-Level Controls:

# Restrict shared memory access
sudo sysctl -w kernel.shmmax=0
sudo sysctl -w kernel.shmall=0
# Or use more granular controls
sudo chmod 1777 /dev/shm  # Sticky bit prevents deletion by non-owners

Container Security:

# Dockerfile - Restrict shared memory in containers
FROM ubuntu:22.04
# ... other instructions ...
# Run with: docker run --shm-size=1m <image>

SSH Hardening:

# ~/.ssh/config
# Use SSH's built-in password handling, not terminal emulator features
PasswordAuthentication no
PubkeyAuthentication yes

Shared Memory Security Policies

Organizational Policy:

1. Inventory: Maintain list of all systems running kitty
2. Update schedule: Establish regular patching cadence
3. Monitoring: Implement continuous monitoring for exploitation attempts
4. Incident response: Define procedures for credential compromise
5. User training: Educate users about terminal security risks

Technical Policies:

# /etc/security/limits.conf
# Restrict shared memory usage per user
* soft memlock unlimited
* hard memlock unlimited
# /etc/sysctl.conf
# Kernel-level shared memory restrictions
kernel.shmmax = 68719476736
kernel.shmall = 4194304

Regular Vulnerability Scanning

Automated Scanning:

# Using Trivy for container scanning
trivy image myregistry/myimage:latest
# Using Grype for system scanning
grype /usr/bin/kitty
# Using OpenSCAP for compliance checking
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Vulnerability Management:

• Subscribe to CVE feeds for kitty: https://github.com/kovidgoyal/kitty/security/advisories
• Integrate vulnerability scanning into CI/CD pipelines
• Establish SLA for patching critical vulnerabilities (24-48 hours)
• Maintain patch inventory and compliance reports

Frequently Asked Questions

What is kitty and why is it used?

Kitty is a modern, GPU-accelerated terminal emulator written in C and Python. It’s designed for performance, extensibility, and advanced features including:

• GPU rendering: Faster text rendering and scrolling
• Image protocol: Display images directly in the terminal
• Ligatures: Support for programming font ligatures
• Customization: Extensive configuration options
• Cross-platform: Available on Linux, macOS, and other Unix systems

Kitty is popular among developers, system administrators, and power users who value performance and modern features over traditional terminal emulators like xterm or GNOME Terminal.

How do I check if my kitty version is vulnerable?

Run the following command:

kitty --version

If the output shows version 0.25.0 through 0.48.x, your installation is vulnerable. Version 0.49.0 and later are patched.

Example outputs:

• kitty 0.30.0 – VULNERABLE
• kitty 0.48.1 – VULNERABLE
• kitty 0.49.0 – PATCHED
• kitty 0.50.0 – PATCHED

Can this vulnerability be exploited remotely?

No, CVE-2026-95835 requires local system access. An attacker must have:

1. A user account on the target system, OR
2. Ability to execute code on the target system

Remote exploitation is not possible through network-based attacks alone. However, remote code execution vulnerabilities in other software could be chained with this vulnerability for a complete attack.

What information can attackers capture?

Attackers can capture any information typed into prompts displayed by kitty, including:

• Passwords: SSH passphrases, sudo passwords, database passwords
• Authentication tokens: API keys, OAuth tokens, JWT tokens
• Credentials: Username/password combinations
• Sensitive data: Any text entered in response to a prompt
• Private keys: Passphrases for encrypted private keys

The attacker cannot capture:

• Information typed in regular shell commands (unless a prompt is involved)
• Data in files or environment variables
• Information from other applications

How long does the upgrade to 0.49.0 take?

The upgrade process typically takes:

• Package manager upgrade: 2-5 minutes (including download and installation)
• From source compilation: 10-15 minutes (depending on system performance)
• Testing and verification: 5-10 minutes
• Total time: 15-30 minutes per system

For enterprise deployments with multiple systems, use configuration management tools to parallelize upgrades across systems.

What should I do if I cannot upgrade immediately?

If you cannot upgrade immediately, implement these mitigations:

1. Restrict access: Limit kitty usage to trusted users only
2. Disable remote control: Set allow_remote_control no in kitty configuration
3. Monitor activity: Watch for suspicious shared memory access
4. Rotate credentials: Change any credentials used in terminal sessions
5. Isolate systems: Separate vulnerable systems from sensitive infrastructure
6. Plan upgrade: Schedule upgrade within 48-72 hours

These mitigations reduce risk but do not eliminate it. Upgrade as soon as possible.

Are other terminal emulators affected?

No, CVE-2026-95835 is specific to kitty. Other terminal emulators like:

• xterm
• GNOME Terminal
• Konsole
• iTerm2
• Alacritty
• Hyper

…are not affected by this vulnerability. However, they may have their own security issues. Maintain security updates for all software.

How can I monitor for exploitation attempts?

Implement monitoring using these techniques:

System Call Monitoring:

auditctl -a always,exit -F arch=b64 -S shm_open -k shm_access

Shared Memory Monitoring:

watch -n 1 'ls -la /dev/shm/'

Process Monitoring:

# Monitor for suspicious kitty instances
ps aux | grep kitty

Log Analysis:

# Check for exploitation attempts
grep -r "shm_open\|shared memory" /var/log/audit/

EDR/SIEM Integration:

• Configure your EDR/SIEM to alert on suspicious shared memory access
• Create detection rules for unexpected /dev/shm activity
• Monitor for credential-related events following suspicious terminal activity

References

Official Sources:

• Kitty GitHub Repository
• Kitty Security Advisories
• CVE-2026-95835 Details

Technical Documentation:

• POSIX Shared Memory
• Linux /dev/shm Documentation
• Kitty Escape Codes

Security Resources:

• NIST Cybersecurity Framework
• CIS Controls
• OWASP Secure Coding Practices

Related CVEs:

• CVE-2021-3807 (Terminal emulator vulnerabilities)
• CVE-2022-24348 (Shared memory security issues)

Document Information:

• Last Updated: 2024
• Classification: Public
• Revision: 1.0

For questions or additional information about this advisory, contact your security team or refer to the official kitty project documentation.