CVE-2026-26982 Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations
Attackers can execute arbitrary commands via hidden control characters in pasted or dropped text, requiring user interaction to trigger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-26982?
CVE-2026-26982 is a medium-severity command injection vulnerability in ghostty-org ghostty, published on 9 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents are complex. Fixed in Ghostty v1.3.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-26982?
It affects 1 product.
Linux distribution packages (1)
ghostty openSUSE:Tumbleweed | All versions | 1.3.0-1.1 |
Products include Ghostty Ghostty.
How do I fix CVE-2026-26982?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-26982 being exploited?
There is no known exploitation of CVE-2026-26982 in the wild and no public exploit code.
Sources
Also known as GHSA-4jxv-xgrp-5m3r, UBUNTU-CVE-2026-26982, openSUSE-SU-2026:10316-1.