Arbitrary code execution through kitty-open.desktop file association
ニャーニャー
Published:
In Debian kitty package, the
kitty-open.desktop file would associate kitty +open with several MIME types.
This could be used to arbitrary trigger code execution by serving a
file with such a MIME type.
This has been introduced in kitty in 73a197fcd (2022-02-06) released as part of v0.24.3. This has been fixed in v0.26.5-5 of the Debian kitty package. Fixed upstream in 537cabca7 released in v0.29.0. Other distributions such as Ubuntu Lunar are still impacted.