VulnerabilityAnalyzed

CVE-2026-26982

Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text.

HIGH 8.8EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents are complex. Fixed in Ghostty v1.3.0.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: ghostty/ghostty
Source: security-advisories@github.com

References

https://github.com/ghostty-org/ghostty/commit/fe7427ed2a1a02aef85495b384cfb8f11ee5efc9Patch
https://github.com/ghostty-org/ghostty/pull/10746Issue Tracking, Patch
https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4jxv-xgrp-5m3rPatch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.