CVE-2026-54056: Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging

Synopsis

This is a symlink-following arbitrary file overwrite vulnerability in the Kitty terminal emulator (versions 0.47.0 and 0.47.1). A network-reachable attacker with a low-privilege account who can get the local user to accept a remote drag-and-drop operation can place a crafted symlink in the staging directory, then send a same-named regular-file entry; because the write path uses openat without O_NOFOLLOW, it follows the symlink and overwrites or truncates any file the local Kitty user can write. Successful exploitation gives the attacker the ability to corrupt or destroy arbitrary local files and degrade service availability. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker controls a remote drag-and-drop source reachable over the network and must be able to initiate a drop session to the target Kitty instance.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account or equivalent session context capable of acting as the remote drag-and-drop source; no anonymous access path is described.

• Victim interactionRequired

  The local Kitty user must accept or initiate the drag-and-drop session, giving the attacker the opportunity to stage the malicious symlink and file entry.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free once the victim accepts the drop, with no race condition or special memory-layout requirement needed beyond sending two crafted entries in sequence.

Blast Radius

• The attacker overwrites or truncates arbitrary files writable by the local Kitty user, including configuration files, credentials, or application data on the host.
• Truncation of critical files (such as database files or application state) degrades or crashes dependent services running as the same user.
• Overwriting executable scripts or configuration files in user-controlled paths can set the stage for follow-on privilege escalation or persistent tampering.