● Covered by 1 source · 1 reportMedium impact1 neutral
Ghostty 1.4.0 Terminal Emulator Released with Performance and Security Updates
Key points
- Ghostty 1.4.0 includes performance and memory improvements.
- It features a complete Kitty graphics implementation with animation.
- Multiple security vulnerabilities were patched in this release.
- The update incorporates 7 months of work from 172 contributors.
Major Performance and Graphics Enhancements
Ghostty 1.4.0 introduces significant performance and memory optimizations. This release also includes a 100% complete implementation of Kitty graphics, featuring animation and relative placements, making Ghostty the first non-Kitty terminal to achieve this.
The update integrates improvements to SSH functionality, alongside hundreds of other fixes and enhancements across all supported platforms. This release represents seven months of development effort, incorporating changes from 172 contributors across 2,889 commits.
Critical Security Vulnerabilities Addressed
Several security vulnerabilities have been patched in Ghostty 1.4.0. These include a paste protection flaw (GHSA-4hwh-wx3w-3fqg) that could allow commands to run without confirmation if carriage returns were not treated as line endings.
Malicious Kitty graphics commands (GHSA-mhff-mv4q-fp63) that could crash or hang Ghostty, force large memory allocations, or access files outside allowed directories have been fixed. Issues where malicious terminal output (GHSA-hcr9-7hcr-mjm8, GHSA-hp9c-qp4q-cpw3) could crash Ghostty via tmux control mode have also been resolved, affecting versions 1.3.0 and 1.3.1.
Additional Security Fixes
A memory corruption vulnerability (GHSA-w9q4-5jvv-mcv4) related to clearing the screen into scrollback with a small scrollback limit has been fixed. Another vulnerability (GHSA-2r63-vmw6-3m3c) allowed crafted directory names to send arbitrary escape sequences via zsh shell integration, potentially replacing the clipboard.
On macOS, a critical vulnerability (GHSA-cw69-wm67-5pv8) was addressed where Cmd-clicking a crafted OSC 8 hyperlink could open unsafe local files or execute arbitrary commands. Ghostty now blocks unsafe targets and requires confirmation for custom URL schemes.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub ghostty-org/ghostty GitHub ThomasDickey/esctest2 GitHub mbadolato/iTerm2-Color-Schemes GitHub raphamorim/rio GitHub vancluever/z2d GitHub ghostty-org/websiteReporting from
Ghostty 1.4.0 has been released, featuring performance and memory improvements, full Kitty graphics implementation, and enhanced SSH integration. The update also addresses multiple security vulnerabilities, including issues with paste protection, malicious Kitty graphics commands, and crafted terminal output.