cvesecurityvulnerability
CVE-2026-72913: Kitty Terminal Command Injection via Chained DCS Escape Sequences
Kitty's @kitty-echo and @kitty-ssh DCS handlers write unauthenticated escape sequence data to the child shell's stdin, enabling command injection when untrusted text is displayed. Fixed in 0.48.2.
