CVE Explorer
CVE-2026-26982
Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"ghostty","vendor":"ghostty-org","versions":[{"status":"affected","version":"< 1.3.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:a1653bb5ce9ce340f15cda5193768564ffd7eb5885a5244202201200379a0aab · sha256:dcae2377bef3d76c… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:a1653bb5ce9ce340f15cda5193768564ffd7eb5885a5244202201200379a0aab · sha256:dcae2377bef3d76c… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:a1653bb5ce9ce340f15cda5193768564ffd7eb5885a5244202201200379a0aab · sha256:dcae2377bef3d76c… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"https://github.com/ghostty-org/ghostty/commit/fe7427ed2a1a02aef85495b384cfb8f11ee5efc9","tags":["x_refsource_MISC"],"url":"https://github.com/ghostty-org/ghostty/commit/fe7427ed2a1a02aef85495b384cfb8f11ee5efc9"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a1653bb5ce9ce340f15cda5193768564ffd7eb5885a5244202201200379a0aab · sha256:dcae2377bef3d76c… · /containers/cna/references/2
{"name":"https://github.com/ghostty-org/ghostty/pull/10746","tags":["x_refsource_MISC"],"url":"https://github.com/ghostty-org/ghostty/pull/10746"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a1653bb5ce9ce340f15cda5193768564ffd7eb5885a5244202201200379a0aab · sha256:dcae2377bef3d76c… · /containers/cna/references/1
{"name":"https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4jxv-xgrp-5m3r","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4jxv-xgrp-5m3r"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:a1653bb5ce9ce340f15cda5193768564ffd7eb5885a5244202201200379a0aab · sha256:dcae2377bef3d76c… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.