Medium, CVSS 4.7crates.ioPublished
Path traversal in rio-vt Kitty graphics protocol handler allows out-of-bounds file delete (and read)
- Affected
- crates.io rio-vt >= 0.0.0-0, < 0.5.29
- Fixed in
- 0.5.29· Vendor fix available
- Issue
- The Kitty graphics protocol handler in `rio-vt` builds a filesystem path from an attacker-controlled APC escape sequence and, for the temp-file medium, only checks that the path *contains the substring* `"tty-graphics-protocol"` before it opens, reads, and `remove_file`s it. There is no `..` rejection and no canonicalization, so a path containing the marker substring plus `..` escapes the terminal's temp directory (path traversal, CWE-22/CWE-23). Because a terminal renders whatever arrives on the PTY (ssh output, a `cat`'d file, CI logs), untrusted output can delete a file outside the temp area and cause its bytes to be read back in. Details The sink is `create_graphic_data()` in `src/ansi/kitty_graphics_protocol.rs`, in the `TransmissionMedium::TempFile` branch, reachable through the public API `rio_vt::ansi::kitty_graphics_protocol::parse`. The path is the base64 APC payload of an `a=t,t=t` command, and the guard is: ```rust let path = Path::new(path_str); if !path.is_file() {…
Recommended action: Upgrade to 0.5.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.