iTerm2 < 3.6.10 / < 3.7.0beta1 Arbitrary Code Execution (CVE-2026-41253)

The version of iTerm2 installed on the remote host is prior to 3.6.10, or prior to 3.7.0beta1. It is, therefore, affected by an arbitrary code execution vulnerability: - Displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious...

CVE-2026-41253

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

CVE-2026-41253

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

CVE-2026-41253

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

CVE-2026-41253

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

CVE-2026-41253

Affected software: iTerm2 versions up to 3.6.9 (with notes in Red Hat and EU sources also referencing iTerm2 &lt; 3.6.10 and

EUVD-2026-23656

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

CVE-2026-41253

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

iTerm2 安全漏洞

iTerm2 is a terminal emulator developed by George Nachman for Mac OS X. Versions of iTerm2 prior to 3.6.9 contained security vulnerabilities. These vulnerabilities stemmed from the possibility of executing code through DCS 2000p and OSC 135 data when displaying .txt files. This was because iTerm2...

PT-2026-33591

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band...

iTerm2 < 3.4.20 RCE (macOS)

The version of iTerm2 installed on the remote host is prior to 3.4.20. It is, therefore, is affected by multiple vulnerabilities: - iTerm2 before 3.4.20 allow potentially remote code execution because of mishandling of certain escape sequences related to tmux integration. CVE-2023-46300 - iTerm2...

iTerm2 < 3.3.6 RCE (macOS)

The version of iTerm2 installed on the remote host is prior to 3.3.6. It is, therefore, affected by a vulnerability: - A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the...

[SECURITY] Fedora 42 Update: timg-1.6.3-5.fc42

A user-friendly terminal image viewer that uses graphic capabilities of terminals Sixel, Kitty or iTerm2, or 24-bit color capabilities and Unicode character blocks if these are not available. On terminals that implement the Sixel protocol, the Kitty Graphics Protocol, or the iTerm2 Graphics...

EUVD-2019-8672

Malware in sbrugna...

EUVD-2019-18907

Malware in sbrugna...

EUVD-2015-9084

Malware in sbrugna...

EUVD-2022-48724

Malicious code in bioql PyPI...

EUVD-2025-2685

Malicious code in bioql PyPI...

EUVD-2023-50523

Malicious code in bioql PyPI...

EUVD-2023-50524

Malicious code in bioql PyPI...