CVE-2024-56803

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. This attack requires an attacker to send malicious escape sequences followed by convincing the user to physically press the "enter" key. Fixed in Ghostty v1.0.1.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
ghostty-orgghostty< 1.0.1

References

Timeline

Published
Dec 31, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-568048.8An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit tCVE-2024-568055.4A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could alCVE-2024-568075.5An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can CVE-2024-568087.8A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have alsCVE-2024-56817.8CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kerneCVE-2024-568103.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informaCVE-2024-568113.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informaCVE-2024-568125.5IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informaCVE-2024-56826.5Improper Restriction of Excessive Authentication Attempts vulnerability in Yordam Information Technology Yordam Library Automation System alCVE-2024-568265.6A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using tCVE-2024-568275.6A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using tCVE-2024-568289.8File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoi