CVE-2025-43929

Name	CVE-2025-43929
Description	open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1103691

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
kitty (PTS)	bullseye	0.19.3-1	vulnerable
	bookworm	0.26.5-5	vulnerable
	trixie, sid	0.41.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
kitty	source	(unstable)	0.41.1-1			1103691

https://github.com/kovidgoyal/kitty/commit/ce5cfdd9caf44c538af800a07162e1f49bd53c35 (v0.41.0)