Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back… (CVE-2024-56803)
Ghostty version 1.0.0 allows attackers to modify the terminal window title using a specific character escape sequence. This modified title can then be inserted back into the command line when the user views a file containing the malicious sequence. Exploitation requires the attacker to send the malicious sequence and convince the user to press the Enter key, potentially leading to arbitrary command execution. The issue is fixed in Ghostty version 1.0.1.
AI Analysis
Technical Summary
Ghostty, a cross-platform terminal emulator, in version 1.0.0 allows an attacker to exploit a vulnerability where a crafted character escape sequence modifies the window title. This altered title is then reinserted into the command line when the user views a file containing the sequence. The attack requires user interaction (pressing Enter) to execute arbitrary commands. This vulnerability is addressed in Ghostty version 1.0.1.
Potential Impact
An attacker can execute arbitrary commands on the victim's system by leveraging the escape sequence to modify the window title and then having the user trigger command execution by pressing Enter. This could lead to unauthorized command execution with the privileges of the user running Ghostty.
Mitigation Recommendations
Upgrade Ghostty to version 1.0.1 or later, where this vulnerability is fixed. Until the update is applied, users should avoid opening untrusted files that may contain malicious escape sequences and be cautious about pressing Enter after viewing such content.
Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back… (CVE-2024-56803)
Description
Ghostty version 1.0.0 allows attackers to modify the terminal window title using a specific character escape sequence. This modified title can then be inserted back into the command line when the user views a file containing the malicious sequence. Exploitation requires the attacker to send the malicious sequence and convince the user to press the Enter key, potentially leading to arbitrary command execution. The issue is fixed in Ghostty version 1.0.1.
CVSS v4.0
Affected software
pkg:deb/ubuntu/ghostty?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Ghostty, a cross-platform terminal emulator, in version 1.0.0 allows an attacker to exploit a vulnerability where a crafted character escape sequence modifies the window title. This altered title is then reinserted into the command line when the user views a file containing the sequence. The attack requires user interaction (pressing Enter) to execute arbitrary commands. This vulnerability is addressed in Ghostty version 1.0.1.
Potential Impact
An attacker can execute arbitrary commands on the victim's system by leveraging the escape sequence to modify the window title and then having the user trigger command execution by pressing Enter. This could lead to unauthorized command execution with the privileges of the user running Ghostty.
Mitigation Recommendations
Upgrade Ghostty to version 1.0.1 or later, where this vulnerability is fixed. Until the update is applied, users should avoid opening untrusted files that may contain malicious escape sequences and be cautious about pressing Enter after viewing such content.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2024-56803
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6a74cf9fbf8831d5391b0549
Added to database: 08/06/2026, 18:17:03 UTC
Last enriched: 08/06/2026, 19:08:48 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.