kovidgoyal records
9 published records for vendor kovidgoyal.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-59 Improper Link Resolution Before File Access ('Link Following')2
- CWE-94 Improper Control of Generation of Code ('Code Injection')2
- CWE-122 Heap-based Buffer Overflow1
- CWE-125 Out-of-bounds Read1
- CWE-346 Origin Validation Error1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
9 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2020-35605No exploit | The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename contkovidgoyal · kitty | Critical9.8 | — | 3.7% | Dec 21, 2020 |
39Monitor | CVE-2026-33642No exploit | Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Checkkovidgoyal · kitty · CWE-125 | Critical9.8 | — | 0.2% | May 19, 2026 |
35Monitor | CVE-2026-33633No exploit | Kitty has a Heap Buffer Overflow in its Graphics Protocol Handlerkovidgoyal · kitty · CWE-122 | High8.8 | — | 0.3% | May 19, 2026 |
31Monitor | CVE-2025-43929Proof of concept | open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked fkovidgoyal · kitty · CWE-346 | High7.8 | — | 0.1% | Apr 19, 2025 |
31Monitor | CVE-2026-42851No exploit | @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCEkovidgoyal · kitty · CWE-94 | High7.8 | — | 0.1% | Jun 12, 2026 |
29Monitor | CVE-2026-42850No exploit | Kitty has a shell command injectionkovidgoyal · kitty · CWE-77 | High7.4 | — | 0.2% | Jun 12, 2026 |
29Monitor | CVE-2026-54057No exploit | Kitty vulnerable to command injection via unsanitized OSC 21 query replykovidgoyal · kitty · CWE-94 | High7.3 | — | 0.1% | Jun 12, 2026 |
28Monitor | CVE-2026-54056No exploit | Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop stagingkovidgoyal · kitty · CWE-59 | High7.1 | — | 0.2% | Jun 12, 2026 |
20Monitor | CVE-2026-54055No exploit | Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocolkovidgoyal · kitty · CWE-59 | Medium5.0 | — | 0.0% | Jun 12, 2026 |
- CVE-2020-3560540Plan
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename cont
CriticalCVSS 9.8No exploitEPSS 3%kovidgoyal · kittyDec 21, 2020
- CVE-2026-3364239Monitor
Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check
CriticalCVSS 9.8No exploitEPSS 0%kovidgoyal · kittyMay 19, 2026
- CVE-2026-3363335Monitor
Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler
HighCVSS 8.8No exploitEPSS 0%kovidgoyal · kittyMay 19, 2026
- CVE-2025-4392931Monitor
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked f
HighCVSS 7.8Proof of conceptEPSS 0%kovidgoyal · kittyApr 19, 2025
- CVE-2026-4285131Monitor
@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
HighCVSS 7.8No exploitEPSS 0%kovidgoyal · kittyJun 12, 2026
- CVE-2026-4285029Monitor
Kitty has a shell command injection
HighCVSS 7.4No exploitEPSS 0%kovidgoyal · kittyJun 12, 2026
- CVE-2026-5405729Monitor
Kitty vulnerable to command injection via unsanitized OSC 21 query reply
HighCVSS 7.3No exploitEPSS 0%kovidgoyal · kittyJun 12, 2026
- CVE-2026-5405628Monitor
Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging
HighCVSS 7.1No exploitEPSS 0%kovidgoyal · kittyJun 12, 2026
- CVE-2026-5405520Monitor
Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol
MediumCVSS 5.0No exploitEPSS 0%kovidgoyal · kittyJun 12, 2026