Nixpkgs security tracker

Permalink CVE-2026-26982

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 2 months, 1 week ago by @mweinelt Activity log

Created suggestion 2 months, 2 weeks ago
@mweinelt accepted 2 months, 2 weeks ago
@mweinelt ignored
3 packages
- tree-sitter-grammars.tree-sitter-ghostty
- python313Packages.tree-sitter-grammars.tree-sitter-ghostty
- python314Packages.tree-sitter-grammars.tree-sitter-ghostty
2 months, 1 week ago
@mweinelt published on GitHub 2 months, 1 week ago

Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations

Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can be used to execute arbitrary commands in some shell environments. This attack requires an attacker to convince the user to copy and paste or drag and drop malicious text. The attack requires user interaction to be triggered, but the dangerous characters are invisible in most GUI environments so it isn't trivially detected, especially if the string contents are complex. Fixed in Ghostty v1.3.0.

References

https://github.com/ghostty-org/ghostty/security/advisories/GHSA-4jxv-xgrp-5m3r x_refsource_CONFIRM
https://github.com/ghostty-org/ghostty/pull/10746 x_refsource_MISC
https://github.com/ghostty-org/ghostty/commit/fe7427ed2a1a02aef85495b384cfb8f11ee5efc9 x_refsource_MISC

Affected products

ghostty

==< 1.3.0

Matching in nixpkgs

pkgs.ghostty

Fast, native, feature-rich terminal emulator pushing modern features

nixos-unstable 1.2.3
- nixpkgs-unstable 1.2.3
- nixos-unstable-small 1.2.3
nixos-25.11 1.2.3
- nixos-25.11-small 1.2.3
- nixpkgs-25.11-darwin 1.2.3

pkgs.ghostty-bin

Fast, native, feature-rich terminal emulator pushing modern features

nixos-unstable 1.2.3
- nixpkgs-unstable 1.2.3
- nixos-unstable-small 1.2.3
nixos-25.11 1.2.3
- nixos-25.11-small 1.2.3
- nixpkgs-25.11-darwin 1.2.3

Ignored packages (3)

pkgs.tree-sitter-grammars.tree-sitter-ghostty

Tree-sitter grammar for ghostty

nixos-unstable 1.2-unstable-2026-01-02
- nixpkgs-unstable 1.2-unstable-2026-01-02
- nixos-unstable-small 1.2-unstable-2026-01-02

pkgs.python313Packages.tree-sitter-grammars.tree-sitter-ghostty

Python bindings for tree-sitter-ghostty

nixos-unstable 1.2+unstable20260102
- nixpkgs-unstable 1.2+unstable20260102
- nixos-unstable-small 1.2+unstable20260102

pkgs.python314Packages.tree-sitter-grammars.tree-sitter-ghostty