Ghostty 1.4 fixes unsafe terminal output and paste handling
Ghostty 1.4 fixes security flaws involving terminal output, pasted commands, crafted directory names and macOS links. Some require a click or paste; others can trigger just by displaying malicious output. The terminal also adds complete Kitty graphics animation support and compresses hidden scrollback. Security fixes make this update relevant even to users who do not need the new display features.
Ghostty · Oct 27, 2026
Why it matters
A terminal interprets control sequences from programs and remote systems, so displaying text can cross a security boundary.
More context
The stable release is dated October 27. Official signed macOS binaries are available; Linux packages are supplied by distributions and community maintainers. Check the installed version and relevant advisories before returning to untrusted logs or repositories.
Keep in mind
Conditions differ by advisory, and some affect only macOS or particular configurations. Package availability varies; this card does not claim every earlier installation is vulnerable to every listed flaw.
Original read