CVE-2025-43929
Quick assessment
Affected
kitty project kitty
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
kitty是印度科维德·戈亚尔（Kovid Goyal）个人开发者的一个基于Python的GPU终端仿真软件。该软件可提供基本的终端功能，并且基于GPU渲染可降低系统负载，采用OpenGL进行渲染，可支持在Linux、Mac上使用。 kitty 0.41.0之前版本存在安全漏洞，该漏洞源于未确认本地可执行文件，可能导致任意代码执行。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-43929
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5
Vulnerability Title
kitty 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
kitty是印度科维德·戈亚尔（Kovid Goyal）个人开发者的一个基于Python的GPU终端仿真软件。该软件可提供基本的终端功能，并且基于GPU渲染可降低系统负载，采用OpenGL进行渲染，可支持在Linux、Mac上使用。 kitty 0.41.0之前版本存在安全漏洞，该漏洞源于未确认本地可执行文件，可能导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| kitty project | kitty | 0 ~ 0.41.0 | - |
|
II. Public POCs for CVE-2025-43929
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | High severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances. | https://github.com/0xBenCantCode/CVE-2025-43929 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-43929
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-43929 (2)
Vendor Advisories for CVE-2025-43929 (1)
Proof of Concept for CVE-2025-43929 (1)
Vendor Pages for CVE-2025-43929 (1)
IV. Related Vulnerabilities
Same product: kitty
-
CVE-2026-95835
Missing ownership check on the shared memory object named by -
CVE-2026-95834
Use after free in the kitty drag and drop protocol when a dr -
CVE-2026-80432
Missing authorization in the kitty drag and drop protocol al -
CVE-2026-80431
Out-of-bounds write in the kitty text sizing protocol allows -
CVE-2026-80430
Improper link resolution in the kitty drag and drop protocol
Same weakness: CWE-346
-
CVE-2026-94485
Next.js: Information disclosure in Next.js App Router metada -
CVE-2026-94486
Next.js: Information disclosure in the Next.js development s -
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at t -
CVE-2026-102588
Moodle: csrf in xml grade import -
CVE-2026-102878
mcp-chrome-bridge through 1.0.31 CORS Origin Bypass
V. Comments for CVE-2025-43929
No comments yet