CVE-2026-26982

CVE-2026-26982 impacts the Ghostty terminal emulator, where it allows control characters in pasted or dropped text, potentially enabling arbitrary command execution in some shell environments. This is a high-severity vulnerability (CVSS 8.8) that requires user interaction, as an attacker must convince a user to copy and paste or drag and drop malicious, often invisible, text. The hidden nature of these dangerous characters makes detection difficult, posing a significant risk of full system compromise. Currently, there is no evidence of active exploitation, nor is public exploit code available. Users are strongly advised to update to Ghostty v1.3.0 or later to remediate this vulnerability.