PT-2024-37077 · Ghostty · Ghostty

Dgl + 1 · Published 2024-12-31 · Updated 2025-01-01 · CVE-2024-56803

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Ghostty version 1.0.0

Description: Ghostty is a cross-platform terminal emulator that allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal. This could allow the attacker to execute arbitrary commands when the user views a file containing the malicious sequence and physically presses the "enter" key.

Recommendations: For Ghostty version 1.0.0, update to Ghostty v1.0.1 to resolve the issue. As a temporary workaround, consider avoiding the use of files that may contain malicious escape sequences until the update is applied. Restrict user interaction with potentially malicious input to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-56803

GHSA-5HCQ-3J4Q-4V6P

Affected Products

Ghostty

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56803.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-56803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56803 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56803 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-56803 · Security Note
• https://ubuntu.com/security/CVE-2024-56803 · Vendor Advisory
• https://github.com/ghostty-org/ghostty/pull/3908 · Note
• https://github.com/ghostty-org/ghostty/security/advisories/GHSA-5hcq-3j4q-4v6p · Note
• https://t.me/cvenotify/105909 · Telegram Post
• https://twitter.com/CVEnew/status/1874232357110141195 · Twitter Post
• https://twitter.com/WireTor/status/1874493486193590610 · Twitter Post
• https://t.me/cvedetector/14066 · Telegram Post
• https://twitter.com/davidgl/status/1874274389732241515 · Twitter Post