CVE-2026-72913
CVE-2026-72913: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.8
High [CVE-2026-72913] Arbitrary Code Execution via Chained DCS Escape Sequences
CVE-2026-72913Source published Source updated
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2. This could lead to a complete compromise of the user's system. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78. Affected Red Hat products: External Secrets Operator for Red Hat OpenShift; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat…
- Affected products in this advisory
- External Secrets Operator for Red Hat OpenShift
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat package: gvisor-tap-vsock
- Source-reported affected versions
- < 0.48.2
- Source-reported fixed versions
- 0.48.2
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.