# Ghostty 1.4.0 fixes terminal-output and command-execution vulnerabilities

_Published Tuesday, October 27, 2026 at 2:06 PM EDT · Security · Latest · Tier 2 — Notable_

![Ghostty 1.4.0 fixes terminal-output and command-execution vulnerabilities — Primary](https://ghostty.org/social-share-card.jpg)

Ghostty released version 1.4.0 on October 27, fixing vulnerabilities that could let malicious terminal output read or delete files outside permitted temporary directories in limited cases. Its release notes also describe fixes for crashes and hangs triggered by malicious output.

On macOS, crafted hyperlinks could lead to arbitrary command execution when users clicked them. Ghostty now blocks unsafe targets and asks users to confirm custom URL schemes. Other fixes address paste protection and crafted file names that could run a different command from the one displayed for confirmation.

The release also compresses hidden scrollback, which maintainers say reduces physical memory use by 70% to 90% for typical text-heavy history. Compression is available on macOS and 64-bit Linux.

## Sources

- [ghostty.org](https://ghostty.org/docs/install/release-notes/1-4-0)

---
Canonical: https://techandbusiness.org/newswire/wtVO5qwIdP0pMuJi9YeE-W
Published: 2026-10-27T18:06:52.488Z
Story chronology: 2026-10-27T16:51:22.000Z
Retrieved: 2026-10-27T19:54:24.387Z
Publisher: Tech & Business (techandbusiness.org)