Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M
CVE-2026-26982Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations
Medium 6.3
In plain English
A medium-severity OS command injection in ghostty from ghostty-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents are complex. Fixed in Ghostty v1.3.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:26.04:LTS | ghostty | no fix listed | UBUNTU-CVE-2026-26982 |
| Ubuntu:26.10 | ghostty | no fix listed | UBUNTU-CVE-2026-26982 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ghostty-org | ghostty | < 1.3.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4jxv-xgrp-5m3r x_refsource_CONFIRM
- https://github.com/ghostty-org/ghostty/pull/10746 x_refsource_MISC
- https://github.com/ghostty-org/ghostty/commit/fe7427ed2a1a02aef85495b384cfb8f11ee5efc9 x_refsource_MISC