The following vulnerability was published for kitty.
CVE-2025-43929[0]:
| open_actions.py in kitty before 0.41.0 does not ask for user
| confirmation before running a local executable file that may have
| been linked from an untrusted document (e.g., a document opened in
| KDE ghostwriter).
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.