CVE-2024-56803

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-56803

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56803.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-56803

Aliases

GHSA-5hcq-3j4q-4v6p

Published

2024-12-31T22:48:33.167Z

Modified

2025-12-05T07:51:30.321760Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ghostty improperly handles window title sequences which can lead to arbitrary command execution

Details

Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. This attack requires an attacker to send malicious escape sequences followed by convincing the user to physically press the "enter" key. Fixed in Ghostty v1.0.1.

Database specific

{
    "cwe_ids": [
        "CWE-94"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56803.json"
}

References

Affected packages

Git / github.com/ghostty-org/ghostty

Affected ranges

Type

GIT

Repo

https://github.com/ghostty-org/ghostty

Events

Introduced

Fixed

3f7c3afaf947280bd2852626ff4599c02d9fb07e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.1"
        }
    ]
}

Affected versions

v1.*

v1.0.0