Upstream information

CVE-2025-43929 at MITRE

Description

open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (MITRE) National Vulnerability Database
Base Score 4.1 7.8
Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local Local
Attack Complexity High Low
Privileges Required None None
User Interaction Required Required
Scope Changed Unchanged
Confidentiality Impact Low High
Integrity Impact Low High
Availability Impact None High
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1241534 [NEW]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Sun Apr 20 07:26:06 2025
CVE page last modified: Mon Oct 6 20:11:23 2025