Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop

Description

Missing Authorization (CWE-862) in drop_enqueue_request() (kitty/dnd.c), in the drop handling path of the drag and drop protocol, in kitty from 0.47.0 before 0.49.0, which allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because the function serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for that drag. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.

A second defect in the same file extends the first beyond the life of the drag. drop_left_child() runs when the drag leaves the window without a drop having occurred, on the platform drag-leave event and when the hovered window changes. It releases the offered MIME list, which is why the two MIME-keyed request forms fail their bounds check afterwards, but it retains the pending request state, the open file descriptor together with the main loop timer that drives the transfer, the directory handles, the URI list and the pending MIME name. A client can therefore keep reading through a retained directory handle, and an in-flight transfer keeps streaming chunks, when no drag is in progress at all.

The drag source supplies the URI list; the file contents are then read from the filesystem by the kitty process itself, using those paths and its own privileges. The user action required is moving a file over the terminal window, which is an ordinary interaction and not one directed at the attacker.

Vulnerability type (CWE)

• CWE-862: Missing Authorization

Affected versions

kitty from 0.47.0 before 0.49.0. The drag and drop protocol was introduced in kitty/dnd.c, first released in v0.47.0 (2026-05-19); releases before that do not contain the affected code. Every release from v0.47.0 to v0.48.2 inclusive is affected. Default status: unaffected.

Score (CVSS 4.0)

Medium (6.0)

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

The confidentiality loss falls on the subsequent system rather than on kitty itself, because the disclosed contents belong to the user's files and not to the terminal.

Solution

Upgrade to kitty 0.49.0 or later.

Patch

Commit 026d11f5, which rejects a drag data request when the window has no recorded drop, returning EPERM with the message drop data can only be requested after a drop. Unlike the adjacent queue-full denial, this one does not end the drag session, so a later genuine drop still works. The same commit rewrites drop_left_child() to close the file descriptor and cancel its transfer timer, clear the pending request state and the directory handles, and release the URI list and the pending MIME name, and amends the protocol specification to require both behaviours of any terminal.

Credits

• C4sh3R - finder
• Cristian Fernández Cornejo - analyst
• Xoán M. Otero Jorge - analyst
• Secur0 CNA - coordinator
• Kovid Goyal - remediation developer Discovery source: External

Official record: CVE-2026-80432

Related advisories

• CVE-2026-80430 - Medium severity
• CVE-2026-80431 - Medium severity