The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6423 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6423-1                   security@debian.org     https://www.debian.org/security/                             Nilesh Patra     August 09, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : kitty     CVE ID         : CVE-2026-42850 CVE-2026-42851 CVE-2026-54055 CVE-2026-54057     Debian Bug     : 1139898

    Multiple security issues were discovered in kitty, a GPU based terminal     emulator, which may result in the execution of arbitrary code, command     injection into the shell running in the terminal, or the overwriting of     arbitrary files, if untrusted content is displayed in a terminal window.

    For the stable distribution (trixie), these problems have been fixed in     version 0.41.1-2+deb13u2.

    We recommend that you upgrade your kitty packages.

    For the detailed security status of kitty please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/kitty

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject     commands within the subshell through kitty error. A special escape code will make kitty return an error,     this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be     run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect     to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could     pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in     use. Version 04.7.0 fixes the issue. (CVE-2026-42850)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
333554	Debian dsa-6423 : kitty - security update	Nessus	Debian Local Security Checks	8/9/2026	8/14/2026	high
320961	Linux Distros Unpatched Vulnerability : CVE-2026-42850	Nessus	Misc.	6/13/2026	8/9/2026	high
338650	openSUSE 16 Security Update : kitty (openSUSE-SU-2026:21599-1)	Nessus	SuSE Local Security Checks	8/21/2026	8/21/2026	high

Detections

Analytics

Plugins Search

high

high

high