PT-2026-24114 · Ghostty · Ghostty

Shibaaa204 · Published 2026-03-09 · Updated 2026-03-19 · CVE-2026-26982

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghostty versions prior to 1.3.0

Description Ghostty allows control characters, such as 0x03 (Ctrl+C), within pasted or dropped text. These characters can be leveraged to execute arbitrary commands in certain shell environments. Successful exploitation requires an attacker to trick a user into copying and pasting or dragging and dropping malicious text. The dangerous characters are generally not visible in most graphical user interfaces, making detection difficult, particularly with complex strings.

Recommendations Update to Ghostty version 1.3.0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26982

GHSA-4JXV-XGRP-5M3R

OPENSUSE-SU-2026:10316-1

Affected Products

Ghostty

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26982.json · Exploit
• https://github.com/ghostty-org/ghostty/commit/fe7427ed2a1a02aef85495b384cfb8f11ee5efc9 · Patch
• https://github.com/ghostty-org/ghostty/pull/10746 · Patch
• https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4jxv-xgrp-5m3r · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26982 · Security Note
• https://ubuntu.com/security/CVE-2026-26982 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26982 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26982 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10316-1 · Vendor Advisory
• https://reddit.com/r/informatiqueFr/comments/1ry2swx/ghostty_13_vient_de_sortir_recherche_dans_le · Reddit Post
• https://twitter.com/CVEnew/status/2031122507588153488 · Twitter Post
• https://t.me/cveNotify/155445 · Telegram Post
• https://suse.com/security/cve/CVE-2026-26982 · Note
• https://t.me/cveNotify/154893 · Telegram Post