ghostty
tip👻 Ghostty is a fast, feature-rich, and cross-platform terminal emulator that uses platform-native UI and GPU acceleration.
- Maintenance
- Active1312 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 18 advisories14 medium, 4 low
- Supported versions
- No scheduleendoflife.date does not track this project
64.1k stars · 3.9k forks · 269 open issues · last release 3 years ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 18 most recent advisories published by the maintainers: 14 medium, 4 low. Check the patched version against the one you run.
- lowGHSA-3r5j-c6rj-xq2vOct 27, 2026Unbounded memory growth via repeated Kitty clipboard aliases
- Affected
- >= 7a940ec02830fcd39f94ea9a28974c2a82d96486, < 44c4c8f55d49e124f19492402a993978949f1326
- Patched in
- 44c4c8f55d49e124f19492402a993978949f1326
- mediumGHSA-qjfx-r533-6vx3Oct 27, 2026Use-after-free when scrollback line limit prunes the cursor page
- Affected
- >= 5b2d3b7df184b8395519baa235ee9539e2fb1a9b, < 65ff54c67df3d55e3ebf4dd31c7afa93c4cfb922
- Patched in
- 65ff54c67df3d55e3ebf4dd31c7afa93c4cfb922
- mediumGHSA-jqr7-69mm-v35hOct 27, 2026Crash when narrowing a very wide page in libghostty-vt
- Affected
- main from d7bb4b863 up to but not including 0af5c9e55
- Patched in
- main at 0af5c9e55
- mediumGHSA-cw69-wm67-5pv8Oct 27, 2026Crafted OSC 8 hyperlinks can lead to arbitrary command execution on macOS
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-mhff-mv4q-fp63Oct 27, 2026Kitty graphics protocol: DoS, integer overflows, resource leaks
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-w9q4-5jvv-mcv4Oct 27, 2026Memory corruption when clearing the screen prunes the cursor page
- Affected
- >= 1.0.0, <= 1.3.1; < e257bb45e6d4d61c14eacdc717be89c6110f99ff
- Patched in
- 1.4.0; e257bb45e6d4d61c14eacdc717be89c6110f99ff
- mediumGHSA-v8cw-fg4j-jcc4Oct 27, 2026Dragged text bypasses paste protection on macOS
- Affected
- >= 1.1.0, <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-mxqx-236q-wrv7Oct 27, 2026Control characters in filenames can execute different commands than confirmed on macOS
- Affected
- >= 1.2.0, <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-mfw9-xcr3-7gfpOct 27, 2026Links detected in terminal output can lead to arbitrary command execution on macOS
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-hp9c-qp4q-cpw3Oct 27, 2026Crash via zero-sized pane layouts in tmux control mode
- Affected
- >= 1.3.0, <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-hcr9-7hcr-mjm8Oct 27, 2026Crash via out of bounds scroll region in tmux control mode
- Affected
- >= 1.3.0, <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-4hwh-wx3w-3fqgOct 27, 2026Carriage returns in pasted text bypass paste protection
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-2r63-vmw6-3m3cOct 27, 2026Crafted directory names can send arbitrary escape sequences via zsh shell integration
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-26982Mar 9, 2026Arbitrary command execution via control characters in paste and drag-and-drop operations
- Affected
- <= 1.2.3
- Patched in
- 1.3.0
- lowGHSA-q9fg-cpmh-c78xSep 15, 2025Ghostty can be used as a vector for privilege escalation from other vulnerable or malicious sources
- Affected
- < 1.2.0
- Patched in
- 1.2.0
- lowGHSA-98wc-794w-gjx3Jan 30, 2025File descriptors leaked to shell
- Affected
- <= 1.0.1
- Patched in
- 1.1.0
- lowGHSA-hfg5-8q2c-crhcDec 31, 2024The file created by `write_*_file` actions have global read permissions
- Affected
- 1.0.0
- Patched in
- 1.0.1
- mediumCVE-2024-56803Dec 31, 2024Improper handling of window title sequences can lead to arbitrary command execution
- Affected
- 1.0.0
- Patched in
- 1.0.1