CVE-2026-26982: 
NixOS vulnerability analysis and mitigation

CVE-2026-26982 is an OS command injection vulnerability in the Ghostty cross-platform terminal emulator that allows arbitrary command execution via invisible control characters embedded in pasted or drag-and-dropped text. It affects all Ghostty versions up to and including 1.2.3, and was disclosed on March 9–10, 2026. The vulnerability was reported by researcher shibaaa204 and fixed in Ghostty v1.3.0. The GitHub Security Advisory assigns a CVSS v3.1 score of 6.3 (Moderate), while Feedly's aggregated data reflects a higher estimate of 8.8 (High) depending on the scoring source (GitHub Advisory, Feedly).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Ghostty failed to sanitize control characters — such as 0x03 (Ctrl+C), 0x1B (ESC), 0x1C (Ctrl+), 0x15 (Ctrl+U), and others — when processing text inserted via paste or drag-and-drop operations. These characters are processed by the kernel PTY line discipline and can break bracketed paste mode protections, allowing them to be interpreted as interactive shell commands rather than literal text. In testing, Bash and Zsh were confirmed vulnerable; Fish and Nu shells showed resilience. The fix, implemented in src/input/paste.zig, replaces a hardcoded set of unsafe control characters with spaces during paste encoding, following xterm's established behavior (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary OS commands in the context of the victim's shell session, with the privileges of the affected user. Because the malicious control characters are invisible in most GUI environments, victims are unlikely to detect the attack — particularly when the payload is embedded within complex or seemingly legitimate text. This can result in high confidentiality, integrity, and availability impacts, including data exfiltration, file modification, or further system compromise (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.025% (0.000250), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically convincing a target to paste or drag-and-drop attacker-controlled text into a Ghostty terminal running Bash or Zsh (GitHub Advisory, Feedly).

1. Craft malicious payload: Prepare a string containing invisible control characters such as 0x03 (Ctrl+C) or 0x1C (Ctrl+) embedded within seemingly benign text (e.g., a code snippet, a file path, or a command). The control characters are not rendered visibly in most GUI clipboard viewers or text editors.
2. Deliver payload to victim: Distribute the malicious string via a web page, document, chat message, or any medium from which the victim might copy text. Alternatively, craft a malicious file or folder name containing control characters for drag-and-drop delivery.
3. Victim pastes or drops text: The victim copies the text and pastes it (Ctrl+V or right-click paste) into a Ghostty terminal session running Bash or Zsh, or drags and drops the malicious item into the terminal.
4. Control character triggers command execution: Ghostty (versions ≤ 1.2.3) passes the raw control characters to the PTY, where the shell interprets them as interactive signals (e.g., 0x03 as Ctrl+C to interrupt a command, or other characters to inject new commands). Depending on the payload structure, this can terminate in-progress input and execute attacker-supplied commands.
5. Arbitrary command execution achieved: The injected commands run with the privileges of the victim's shell session, enabling data exfiltration, backdoor installation, or further lateral movement (GitHub Advisory, Patch PR).

• Logs: Shell history files (e.g., ~/.bash_history, ~/.zsh_history) containing unexpected commands that the user did not knowingly type, particularly commands appearing immediately after a paste event.
• Process: Unexpected child processes spawned from the shell shortly after a paste or drag-and-drop operation (e.g., curl, wget, nc, python, or reverse shell processes).
• Network: Unusual outbound connections from the user's workstation to unknown external IPs or domains following terminal paste activity.
• File System: Unexpected new files, scripts, or cron jobs created under the user's home directory or /tmp around the time of the paste event.

The only complete fix is upgrading Ghostty to version 1.3.0 or later, which replaces unsafe control characters (including 0x03, 0x1B, 0x1C, 0x15, 0x1A, and others) with spaces during paste encoding. There are no configuration-based workarounds available in affected versions. As a precautionary measure, users on affected versions should manually inspect clipboard contents before pasting into a terminal, avoid pasting text from untrusted sources, and prefer shells such as Fish or Nu that showed resilience in testing (GitHub Advisory, Ghostty Release Notes).

The vulnerability was disclosed by Ghostty maintainer mitchellh via a GitHub Security Advisory on March 9, 2026, with the fix merged on February 16, 2026 ahead of the v1.3.0 release. Technology media outlet Heise covered the Ghostty 1.3.0 release, noting the security fix among new features such as scrollback search. The openSUSE security mailing list also published an announcement referencing the update. Community reaction was generally measured given the requirement for user interaction and the moderate severity assigned by the project (GitHub Advisory, Heise, openSUSE).