What changed
Released October 27, 2026, Ghostty 1.4.0 includes seven GitHub security advisories. GHSA-mhff-mv4q-fp63 allows malicious Kitty graphics output to cause crashes, large allocations and, in limited circumstances, file reads or deletions outside allowed temporary directories. Two tmux control-mode flaws crash windows even without tmux installed. A narrow scrollback memory-corruption path needs a small scrollback limit; shell integration can process crafted directory names into escape sequences; two macOS link-opening flaws require user clicks. The release also compresses idle scrollback, increases the default limit from 10MB to 50MB, and improves PTY and VT parsing.
Why it matters
Terminals display untrusted output from builds, logs, SSH sessions and cloned repositories. Some flaws require only displaying crafted output, rather than running a malicious command. Developers should upgrade, distinguish the macOS click-required flaws from output-only issues, and retest shell integration. Vendor-reported performance gains should not be treated as universal benchmarks.
Security fixes have different prerequisites
Ghostty lists seven advisories: malicious Kitty graphics could cause hangs, excessive allocation and limited unauthorised file operations; two tmux control-mode layouts could crash all windows; a scrollback bug can corrupt memory with a very small scrollback-limit (the default is not known affected); crafted directory names via zsh integration can inject OSC 52 clipboard escape sequences; macOS clickable hyperlinks and detected links can open unsafe local files or URL schemes but require a click. These are not equivalent to universal remote code execution.
Compression reduces resident, not virtual, memory
Idle offscreen scrollback is compressed and restored on demand. Ghostty reports 70–90% physical-memory savings for typical text-heavy history on macOS and 64-bit Linux. Default scrollback rises to 50MB. Hidden macOS tabs release GPU resources. Actual results depend on text, graphics, platform and usage.
I/O and parser gains
The vendor reports 25–55% higher end-to-end macOS PTY throughput on its test hardware after separating reads from parsing, with faster VT parsing and full Kitty graphics protocol coverage. These are vendor tests, not independently reproduced cross-platform measurements.
Operator response
Install Ghostty 1.4.0 or a newer fixed build, reopen sessions and regression-test tmux, Kitty graphics, shell integration, clipboard and link handling. Be cautious with untrusted terminal hyperlinks and output. Check resident-memory changes in your actual workloads.