CVE-2025-43929: Kovidgoyal Kitty

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

Affected products

• Kovidgoyal Kitty: before 0.41.0 (fixed in 0.41.0)

Published 2025-04-20. Last modified 2026-06-17.