Omarchy has changed its Kitty configuration after a security issue was identified with allow_remote_control yes.
That setting allows Kitty’s remote-control protocol to accept commands from terminal output, meaning untrusted output could potentially execute commands as the current user. Kitty itself defaults this setting to no; the exposure came from Omarchy explicitly enabling it so other parts of the desktop could query the active terminal’s working directory.
The change disables remote control by default and migrates existing explicit yes settings to no. Users affected by the migration need to fully close and reopen Kitty, as existing processes remain exposed until they exit.
There is a small trade-off: Omarchy can no longer reliably determine the active Kitty tab/pane’s working directory via its socket, so new terminal or Files launches may occasionally fall back to the home directory.
The associated migration tests reportedly pass, although no live Kitty test was run in the test environment
"Alright ai, now make me a cool linux distro. Don’t add too much of that facism we talked about. Oh and to get funding from the NSA we need to slip in. Misconfiguration. Make it look accidental. "
Wait… An AI slop ‘distro’ has a significant, built in RCE vulnerability? No way.
🤣🤣🤣 First XLibre, now this. Right-wingers have no right to use the term LIBRE.
Why do you need some terminal remote control for determining the working directory of a terminal exactly? Can’t you just go down the process tree until you find the shell and do
realpath /proc/<pid>/cwdon it? Am I missing something?
