At today's meeting, Omarchy & Open Source funding was discussed. Security was one aspect of that. And, on cue, Brodie Robertson has a video out about: This Security Bug Is Too Funny To Ignore It has to do with Kitty terminal (now the default terminal in Omarchy) with kind of crazy default settings. Like "allow_remote=yes". Some links:
As a POC, unzip the attached pwn.zip <https://github.com/kovidgoyal/kitty/files/3749391/pwn.zip> file, and run |cat pwn.txt| in a kitty instance with remote control enabled. It will run the command |touch /tmp/pwned|. This could easily have been called README instead and the command could have been |rm -rf /|. The kitty got pwned by a cat! This breaks a lot of deep implicit assumptions, such as "catting a file should be like, the safest thing to do, ever". Ouch!
https://github.com/kovidgoyal/kitty/issues/2084 It has been known for several decades that terminal control sequences are a security nightmare. They can get injected to the terminal by the most innocuous actions, such as cat-ting a text file or ... github.com Kitty's remote control is fundamentally insecure · Issue #2084 · kovidgoyal/kitty <#> It has been known for several decades that terminal control sequences are a security nightmare. They can get injected to the terminal by the most innocuous actions, such as cat-ting a text file or receiving an e-mail or IM message (if yo... 🔗 https://github.com/kovidgoyal/kitty/issues/2084 <https://github.com/kovidgoyal/kitty/issues/2084> x.com blasty (@bl4sty) on X <#> 🚨 RELEASE: Omarchy Linux Kitty terminal Remote Code Execution exploit 🚨 Stop. Using. This. GARBAGE. If you install kitty (a popular terminal emulator) on Omarchy Linux you open yourself to REMOTE CODE EXECUTION BY LOOKING AT THINGS. in the screenshot you can see `curl something` leading to si… 🔗 https://x.com/bl4sty/status/2096647017992982592 <https://x.com/bl4sty/status/2096647017992982592>