Ghostty 1.4.0 Completes the Kitty Protocol and Patches 10 Security Flaws

⏱️ Reading time: 9 min

Ghostty 1.4.0 now lets you animate full Kitty images, something no other terminal outside Kitty had achieved until today.

📑 En este artículo

1. TL;DR
2. What is Ghostty
3. What happened with Ghostty 1.4.0
4. Project context and history
5. Technical details: how the complete Kitty protocol works
6. Impact and security: ten flaws fixed
7. What’s next for the Ghostty terminal emulator
8. Frequently Asked Questions
   1. What is the Kitty graphics protocol that Ghostty now fully supports?
   2. Is Ghostty free and open source?
   3. Which macOS versions does the new Ghostty release support?
   4. Do the security flaws fixed in Ghostty require updating immediately?
   5. What programming language does the terminal written in Zig use?
9. References

The release, published on October 27, 2026 by Mitchell Hashimoto’s team, adds up to seven months of work, 172 contributors, and 2,889 commits, plus ten security fixes.

TL;DR

• Ghostty 1.4.0, released on October 27, 2026, completes the Kitty graphics protocol with animation.
• The emulator is the first terminal outside Kitty to support relative image placements.
• The release fixes 10 security advisories, including flaws in paste handling and tmux control mode.
• macOS 27 (Golden Gate) now works without the visual defects present in the 1.3.1 beta.
• Seven months of development and 172 contributors produced 2,889 commits in this cycle.

What is Ghostty

Ghostty is an open source terminal emulator written in Zig, created by Mitchell Hashimoto, co-founder of HashiCorp, and publicly released in 2024. It renders using the system’s GPU and uses each platform’s native widgets instead of Electron. The latest version, Ghostty 1.4.0, adds the complete Kitty graphics protocol.

The project is gaining ground against alternatives like iTerm2, Windows Terminal, or Alacritty thanks to its GPU rendering and features designed for modern terminals: shell integration via SSH, Nerd Font theme support, and, as of this version, a complete graphics protocol. Ghostty runs on Linux and macOS, and installs via native package managers like Homebrew, pacman, or each distribution’s repositories.

What happened with Ghostty 1.4.0

The team published the new Ghostty release on October 27, 2026, after seven months of work with 172 contributors and 2,889 commits. The changelog covers three fronts: support for macOS 27 (internal name Golden Gate), the full completion of the Kitty graphics protocol, and ten security fixes.

On macOS 27, tabs in the title bar (with macos-titlebar-style = tabs) align correctly again, the native tab bar no longer renders as a solid gray stripe over the user’s theme, and macos-titlebar-style = hidden no longer covers the first lines of the terminal when the system has Reduce Transparency enabled. The app icon also lost a thin border it had carried over from previous versions. The terminal written in Zig remains backward compatible, from macOS 13 (Ventura) onward.

Beyond the headlines, the notes detail SSH integration improvements (the terminal now forwards environment variables and theme configuration more reliably when connecting to a remote server) and an overall reduction in memory usage during long sessions with many open tabs. The team also resolved dozens of minor rendering reports accumulated since version 1.3.1.

Project context and history

Mitchell Hashimoto, known for founding HashiCorp (creator of Terraform and Vagrant), publicly introduced Ghostty in 2024 after years of private development. The stated goal was to build a fast, cross-platform terminal with native GPU support, without relying on frameworks like Electron. Since then, the project has gone through versions 1.0 to 1.3.1, adding features such as tmux integration, SSH improvements, and partial support for the Kitty graphics protocol.

The choice of Zig isn’t accidental: the language compiles to small binaries, doesn’t depend on a garbage collector, and makes it easier to achieve the fine-grained memory control a terminal emulator needs to draw thousands of text cells per second without overloading the GPU. That technical foundation is what made it possible, in this release, to lower memory consumption without sacrificing features.

That partial graphics protocol support caused friction. Ghostty 1.3.0 and 1.3.1 were exposed to a flaw (GHSA-hcr9-7hcr-mjm8) that allowed closing all open windows just by displaying malicious text in tmux control mode, without tmux even being installed. Version 1.4.0 fixes that flaw and a related one involving zero-size panes (GHSA-hp9c-qp4q-cpw3), both inherited from those two versions.

Technical details: how the complete Kitty protocol works

The Kitty graphics protocol lets a terminal program transmit image data directly to the emulator using APC escape sequences, instead of relying on the system’s graphics server. The program sends the image in base64-encoded chunks, the terminal decodes them, composites the result over the text grid, and displays it at the indicated position. Through version 1.3.1, Ghostty supported transmitting static images but not animation or relative positioning.

Animation adds one more step: the program transmits multiple frames with timing and composition metadata, and the terminal takes care of playing them in order, calculating when to pause the animation if the tab loses focus, and freeing the memory of frames that are no longer needed. Relative positioning lets a “child” image anchor to the placement of a “parent” image: if the program moves the parent image, the child moves with it without the program having to recalculate coordinates on every frame.

sequenceDiagram
participant P as Program
participant T as Ghostty
P->>T: sends image frame (APC)
T-->>P: confirms receipt
Note over P,T: repeats for each frame of the animation
P->>T: indicates playback order
T-->>P: plays and pauses if the tab loses focus

The team also did a full conformance pass against the spec and against Kitty itself, fixing dozens of behavioral differences. For example, images now scroll along with the text inside scroll regions, and retransmitting an image ID now replaces the previous image instead of duplicating it.

In practice, relative positioning is useful for programs that draw composite graphics: an image viewer can show a floating thumbnail over the main image, or a monitoring tool can overlay a status icon on a larger chart, all without recalculating absolute coordinates on every frame.

The change is noticeable with any program that uses the protocol. For example, displaying an animated GIF with kitten icat:

kitten icat logo-animado.gif

Before version 1.4.0, Ghostty only displayed the first frame of the GIF. With this release, the GIF plays in full and pauses automatically if you switch tabs.

Impact and security: ten flaws fixed

Beyond the animated images, version 1.4.0 closes out ten security advisories. Most require user interaction (pasting text, cmd-clicking a link, drag and drop, or confirming a dialog): these aren’t remotely and silently exploitable flaws. Among the most relevant, a bug in paste protection that didn’t treat carriage returns as line endings allowed executing a command without confirmation in programs that don’t use “bracketed paste” (GHSA-4hwh-wx3w-3fqg). The team also fixed malicious graphics protocol commands that could hang the program, force massive memory allocations, or, in limited cases, read or delete files outside the allowed temporary directories (GHSA-mhff-mv4q-fp63).

The rest of the fixed advisories include a bug that corrupted memory when clearing the screen into the scrollback with a buffer limit configured to zero (GHSA-w9q4-5jvv-mcv4), and one that allowed the name of a directory cloned from an untrusted repository to trigger arbitrary escape sequences through the zsh or bash integration, for example to replace clipboard contents (GHSA-2r63-vmw6-3m3c). On macOS, opening a file whose name contains control characters could execute a different command than the one shown in the confirmation dialog (GHSA-mxqx-236q-wrv7).

A curious detail: the lead maintainer requested CVE numbers for these advisories weeks before the release, but GitHub still hadn’t assigned them by the time the notes were published. It’s a reminder that the CVE identifier and the actual security advisory don’t always arrive at the same time.

📌 Note: none of Ghostty 1.4.0’s ten advisories has a formal CVE number assigned yet; the project only published GitHub’s GHSA identifiers.

What’s next for the Ghostty terminal emulator

The project didn’t publish a fixed timeline for the next version, but the pattern from recent cycles (seven months passed between 1.3.0 and 1.4.0) suggests 1.5 wouldn’t arrive before mid-2027. The security fixes are expected to receive retroactive CVE numbers once GitHub assigns them, and the team is likely to keep polishing the SSH integration this release already improved.

The jump in contributions, 172 different people in a single cycle, is also a notable data point for a project that just turned two years since its public launch: it suggests the community around the terminal written in Zig keeps growing instead of depending solely on its original author.

One limitation that remains: Ghostty has no native Windows support, which leaves it out of the running for teams that work exclusively on that system. For those cases, alternatives like Windows Terminal or WezTerm remain the most direct option.

Try it yourself: if you already use Ghostty, update with brew upgrade ghostty on macOS or with your distribution’s package on Linux, and run kitten icat on an animated GIF to see the complete graphics protocol in action.

Frequently Asked Questions

What is the Kitty graphics protocol that Ghostty now fully supports?

It’s a system of escape sequences that lets a terminal program transmit and animate images directly, without going through the system’s graphics server. Ghostty 1.4.0 is the first terminal outside Kitty to implement it at 100%, including animation.

Is Ghostty free and open source?

Yes. The terminal emulator is distributed under an open source license, and its source code is available on GitHub, along with the complete changelog for every version.

Which macOS versions does the new Ghostty release support?

From macOS 13 (Ventura) onward, including the newly arrived macOS 27 (Golden Gate), with specific visual compatibility fixes for the latter.

Do the security flaws fixed in Ghostty require updating immediately?

Most require the victim to interact (pasting text, clicking, or confirming a dialog), so the risk isn’t silent remote execution, but it’s still advisable to update as soon as possible because several advisories affect users without their noticing, such as when cloning a repository with a crafted directory name.

What programming language does the terminal written in Zig use?

Ghostty is written in Zig, a low-level language designed for performance and memory control without a garbage collector, which explains part of the memory improvements this version brings.

References

• Ghostty.org: release notes for version 1.4.0 with the full changelog and security advisories.
• GitHub: official repository for Ghostty’s source code.
• Kitty graphics protocol: the official specification of the graphics protocol that Ghostty now implements completely.
• GHSA-4hwh-wx3w-3fqg: security advisory about paste protection and carriage returns.

📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de Mohammad Rahmani en Unsplash