CVE-2025-43929 PoC — kitty 安全漏洞

Source

https://github.com/0xBenCantCode/CVE-2025-43929

Associated Vulnerability

Title: kitty 安全漏洞 (CVE-2025-43929)
Description:open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

Description

High severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances.

Readme

# CVE-2025-43929
Proof-of-concept for CVE-2025-43929, a high-severity vulnerability in KiTTY allowing for local executables to be ran without user confirmation under certain circumstances

## Vulnerability Type
CWE-346: CWE-346 Origin Validation Error

## Vulnerability Description
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

## Vulnerability Demo
https://github.com/user-attachments/assets/87f0b35e-97b4-4b11-b495-b0112ae590e5

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →