Ghostty 1.4.0 Release Addresses Multiple Vulnerabilities

• •Ghostty 1.4.0 fixes multiple vulnerabilities in the Kitty graphics protocol.
• •Users must display malicious output to exploit these vulnerabilities.
• •The release includes significant performance enhancements and security improvements.

Ghostty 1.4.0, released on October 27, 2026, includes significant performance improvements and fixes for multiple vulnerabilities affecting the Kitty graphics protocol. The vulnerabilities, identified as GHSA-mhff-mv4q-fp63 and others, allow attacker-controlled terminal output to crash or hang Ghostty and, in some cases, read or delete unintended local files. Users must display malicious output to trigger these vulnerabilities, which could occur through running malicious programs or connecting to compromised hosts. The release notes detail various security issues, including improper validation of graphics commands and temporary file path restrictions. Ghostty has not reported any of these vulnerabilities, but users are encouraged to update to the latest version to mitigate risks. The vulnerabilities affect all platforms supported by Ghostty.