Cat2Shell
CVE-2026-NYAAN · a.k.a. “Purrgeddon”
A critical vulnerability present for roughly 9,500 years. Leave your terminal open and walk away, and a nearby cat will walk across your keyboard and obtain a fully interactive shell. Instantly. As root.
(up to 11.0 depending on the cat’s mood)
(from the moment you stand up)
(since humans and cats moved in together)
(tail optional)
01What is Cat2Shell?
Terminals are designed to pass keyboard input straight to the shell. The problem is that keyboards are warm, flat, and exactly one cat in size.
The attacker (hereafter “the cat”) only needs to land on the keyboard to execute arbitrary strings with your privileges. No authentication required. The cat is already inside your home. You invited it in yourself, and you feed it every day. Researchers have called it “the cutest insider threat in history.”
02Proof of Concept
A fully weaponized PoC is published below. Click to type a command, or let the cat walk. Start with help.
This very page also contains a shell. If you are concerned, close the tab before the cat arrives.
03Attack Steps
- Leave your terminal open and get up to make coffee.
- There is no step 2. The cat handles it.
Exploitation requires physical access, four legs, and a strong desire to sit on whatever the human is looking at. According to threat intelligence, all cats ship with these by default.
04Affected Systems
| Product | Attack vector | Status |
|---|---|---|
| MacBook | Warm keyboard while charging. A heated blanket, as far as the cat is concerned | VULNERABLE |
| ThinkPad | The red TrackPoint nub is mistaken for prey | VULNERABLE |
| Custom mechanical keyboard | Targeted for its satisfying key feel. Keycaps get carried off | VULNERABLE |
| Vim | The cat doesn’t know :q. Nobody escapes | VULNERABLE |
| Emacs | Cats can press Ctrl and Meta at the same time. Better than most humans | VULNERABLE |
| Production SSH sessions | That tab you forgot to close. Cats don’t distinguish prod from staging | VULNERABLE |
| Zoom / Google Meet | Unmuted, camera on, a full-screen view of the cat’s backside | VULNERABLE |
| Pen and paper | The pen gets knocked off the desk. No shell is obtained | PARTIAL |
| Cardboard box | Cats prioritize boxes over keyboards (see Mitigations) | DECOY |
| Dogs | No known vector. May eat the keyboard, though | NOT AFFECTED |
05Indicators of Compromise
If you observe any of the following, your system has already been compromised.
;;;;;;;;;;;;;;'''''''' or gggggggggggggg#. The cat was root all alongOnce compromise is confirmed, first disconnect from the network, then gently remove the cat from the keyboard. The cat will return.
06Mitigations
No patch is available from the vendor (the cat). Our inquiries were left on read.
Lock your screen when you step away
The most effective countermeasure. The cat will, however, sleep on the lock screen.
Provide a warmer spot
Cardboard boxes, sunbeams, freshly laundered clothes. Deploy a honeypot more attractive than your keyboard.
Bribe with food
A partial mitigation. Effective for about two hours. Recurrences come with escalated demands.
Put the keyboard away
Cats possess a known bypass via the trackpad.
Don’t own a cat
Fully remediates the vulnerability. Also fully remediates your happiness.
07Disclosure Timeline
08FAQ
Am I affected?
If you live in the same building as a cat, yes. If a cat merely lives nearby and your window is open, also yes.
Can the attacker be identified?
Yes. It is usually grooming itself on your chair as if nothing happened.
Is the cat malicious?
No. The cat is simply protesting how much time you spend looking at screens. This is less a vulnerability than feedback on the spec.
Will it be fixed?
No. Fixing it would leave the research team with nothing to write their next blog post about.
Should I panic?
Yes. Panic is the recommended response to any vulnerability that has a website and a logo. Afterwards, pet your cat.