TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Ghostty 1.4.0 adds animated images and relative placements under the Kitty graphics protocol, alongside scrollback memory savings and broad performance work. Its release notes also list multiple security vulnerabilities and fixes, including issues triggered by malicious terminal output or user actions.
Ghostty 1.4.0 is a major release of the terminal emulator, adding animated Kitty graphics and relative image placement while reducing memory use for stored scrollback. The project’s release notes also document multiple security vulnerabilities and fixes, making the update relevant both to users of image-rendering terminal programs and to people who may be running affected earlier versions.
Ghostty says the release completes its implementation of the Kitty graphics protocol, including animation and relative placements. Animated images, such as a GIF displayed with Kitty’s kitten icat tool, can now play rather than remaining a still frame. Ghostty says it supports frame transmission, composition and playback controls, and pauses animations while the terminal is not visible. Relative placement allows one image to move with another image it is positioned against.
The project reports that image payload parsing is about 16 times faster in its benchmark, which processed 64 MiB of image data on x86_64 Linux. That figure describes a specific benchmark, not a general speed increase for every terminal task. Ghostty also says it checked its implementation against the protocol specification and Kitty itself, correcting behavioral differences in areas such as image scrolling and handling retransmitted image IDs.
For memory use, the release compresses scrollback pages outside the visible area. Ghostty says typical text-heavy history uses 70% to 90% less physical memory when compressed; compression runs while the terminal is idle, with pages decompressed on demand when users scroll back. The release notes describe seven months of work, contributions from 172 contributors and 2,889 commits, along with hundreds of other fixes and improvements across platforms.
Security Fixes and Daily Use
The release matters for users who keep long terminal histories open, use terminal programs that display images, or rely on Ghostty for development work. The reported scrollback savings could reduce the memory cost of lengthy text sessions, while animated graphics and protocol compatibility can improve how supported tools behave. The performance result is promising but is limited to the stated image-parsing benchmark.
Security is another reason to review the update. Ghostty lists vulnerabilities involving paste handling, crafted graphics commands, tmux control-mode output, shell integrations and, on macOS, links and drag-and-drop. Some issues required user interaction, such as clicking a crafted link or pasting content; others could be triggered by displaying malicious terminal output. The project describes fixes in 1.4.0, but users should consult the advisories and release notes for the affected versions and conditions rather than treating every issue as equally exploitable.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Logitech MX Keys S Wireless Keyboard, Graphite
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
Seven Months of Ghostty Changes
Ghostty 1.4.0 follows version 1.3.1 and brings changes accumulated over seven months, according to the project. The release notes say the Kitty animation and relative-placement features were the last major parts of that protocol that Ghostty did not support. The project calls its implementation the first outside Kitty itself to cover 100% of the published specification; that is Ghostty’s characterization of its conformance work.
The update also addresses platform compatibility. Ghostty says version 1.4 supports macOS 27, codenamed Golden Gate, with fixes for title-bar tabs, window appearance and other behaviors. It remains compatible with macOS 13 (Ventura) and later, according to the release notes. The macOS 27 support follows compatibility work in 1.3.1, which the project says worked on that system but had some visual issues.
Among the published security issues, Ghostty says malicious Kitty graphics commands could crash or hang the application, cause very large allocations or, in limited cases, read or delete files outside permitted temporary directories. Other advisories describe crashes from malicious output and risks tied to crafted directory names or links. The release notes state that some vulnerabilities affect Ghostty 1.3.0 and 1.3.1. They also say requested CVE numbers had not yet been assigned by GitHub when the notes were written.
“Our Kitty graphics implementation now covers 100% of the published specification.”
— Ghostty release notes
Advisory Scope and CVE Status
The release notes do not provide a single summary of which users are exposed under each configuration, nor do they establish that every listed issue affects every platform or version. They describe particular triggers and, for some advisories, identify versions or platform conditions. Users should check the linked security advisories for details on their own setup.
Ghostty says it requested CVE identifiers for the listed issues but had not received them from GitHub when the release notes were prepared. The notes say the identifiers would be added if assigned. The project’s performance and memory figures are also its own reported measurements; the material provided does not include independent benchmark results or a broad comparison with other terminals.
Upgrade and Check Advisories
Users can review the Ghostty 1.4.0 release notes and installation instructions to determine how to update on their platform. People running versions 1.3.0 or 1.3.1 should pay particular attention to the advisories that name those releases, as well as the specific fixes and conditions described by Ghostty. The project says it will update its notes if CVE identifiers are assigned; no further release date or follow-up milestone is specified in the source material.
Key Questions
What is new in Ghostty 1.4.0?
The update adds Kitty graphics animation and relative placements, compresses non-visible scrollback to reduce its physical memory use, and includes performance, compatibility and security fixes.
Does Ghostty 1.4 support animated images?
Yes. Ghostty says Kitty-protocol animations can play, with support for frame transmission, composition and playback controls. Animations pause when the terminal is not visible.
How much memory can scrollback compression save?
Ghostty reports a 70% to 90% reduction in physical memory for compressed, non-visible pages in typical text-heavy history. The figure applies to those pages, not necessarily to total application memory.
Which Ghostty versions are named in the security notes?
The release notes specifically say some issues affect Ghostty 1.3.0 and 1.3.1. Other advisories list particular triggers or platform conditions. Check the individual advisories to confirm whether an issue applies to your setup.
Have CVE numbers been assigned to the vulnerabilities?
Ghostty’s release notes said the requested CVE identifiers had not been assigned by GitHub at the time the notes were written. The project said it would add them if they became available.
Source: ghostty.org
