CVE-2025-43929 PoC — kitty 安全漏洞

Description

High severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances.

介绍

# CVE-2025-43929
Proof-of-concept for CVE-2025-43929, a high-severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances

## Vulnerability Type
CWE-346: CWE-346 Origin Validation Error

## Vulnerability Description
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

## Vulnerability Demo
https://github.com/user-attachments/assets/87f0b35e-97b4-4b11-b495-b0112ae590e5

文件快照

备注