CVE-2025-43929

MEDIUM

Kovidgoyal Kitty < 0.41.0 - Origin Validation Error

Title source: rule

Description

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

Exploits (1)

nomisec WRITEUP
by 0xBenCantCode · poc
https://github.com/0xBenCantCode/CVE-2025-43929

References (5)

Scores

CVSS v3 4.1
EPSS 0.0006
EPSS Percentile 17.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE
CWE-346
Status published

Affected Products (1)

kovidgoyal/kitty < 0.41.0

Timeline

Published Apr 20, 2025
Tracked Since Feb 18, 2026