CVE-2024-38395

2024-06-1601:15:48

Google

osv.dev

iterm2

security issue

window title

remote code execution

software

8.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

JSON

In iTerm2 before 3.5.2, the “Terminal may report window title” setting is not honored, and thus remote code execution might occur but “is not trivially exploitable.”

CPENameOperatorVersion
iterm2eq20190429-nightly
iterm2eq20220601-nightly
iterm2eq3.3.2beta2
iterm2eq20201025-nightly
iterm2eq20221115-nightly
iterm2eq20190323-nightly
iterm2eq20220718-nightly
iterm2eq3.3.0beta6
iterm2eq3.4.5beta1
iterm2eq20190313-nightly

Name	Operator	Version
iterm2	eq	20190429-nightly
iterm2	eq	20220601-nightly
iterm2	eq	3.3.2beta2
iterm2	eq	20201025-nightly
iterm2	eq	20221115-nightly
iterm2	eq	20190323-nightly
iterm2	eq	20220718-nightly
iterm2	eq	3.3.0beta6
iterm2	eq	3.4.5beta1
iterm2	eq	20190313-nightly