Ghostty 1.4 Completes Kitty Graphics and Ships Five Security Fixes

Ghostty 1.4.0 shipped on October 27, 2026, after seven months of work and 2,889 commits from 172 contributors. Its headline item is a 100% complete Kitty graphics implementation, animation and relative placements included — the first terminal that is not Kitty to get all the way there. Large performance and memory improvements, SSH integration changes and hundreds more fixes ride along across all platforms.

Completeness in a graphics protocol is not free. A terminal that draws Kitty images parses payloads handed to it by whatever program is running, which means bytes someone else may control. The advisory GHSA-mhff-mv4q-fp63 says malicious Kitty graphics commands could crash or hang Ghostty, force huge allocations, or in limited cases read or delete files outside the allowed temporary directories. “This only requires displaying malicious output.”

Four more advisories follow. Paste protection ignored carriage returns as line endings, so a paste could run an unconfirmed command where bracketed paste is off, though that needs the copy-paste itself. Two tmux control mode bugs could close every window with no tmux installed; both hit 1.3.0 and 1.3.1. Clearing the screen into scrollback could corrupt memory if it deleted a page holding a styled cursor.

The interesting part is that the completeness claim and the exposure shipped together. Image-heavy terminal tools — preview panes, plots, file managers — now have a reason to pick Ghostty; everyone else is upgrading for the patches. 1.3.0 and 1.3.1 can lose every open window to output nobody asked for, which is reason enough. Picture a paste running an unconfirmed command, then upgrade before opening another tab.