George Nachman

10 exploits Active since Sep 2017
CVE-2015-9231 WRITEUP HIGH WRITEUP
iTerm2 3.x < 3.1.1 - Unauthenticated Exposure of Sensitive Information via DNS Queries
iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext without the user being aware.
CVSS 7.5
CVE-2023-46300 WRITEUP CRITICAL WRITEUP
iTerm2 < 3.4.20 - Remote Code Execution via tmux Escape Sequence Mishandling
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.
CVSS 9.8
CVE-2023-46301 WRITEUP CRITICAL WRITEUP
iTerm2 < 3.4.20 - Remote Code Execution via Escape Sequence Mishandling
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
CVSS 9.8
CVE-2024-38395 WRITEUP CRITICAL WRITEUP
iTerm2 3.5.0-3.5.1 - Remote Code Execution via Window Title Reporting
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
CVSS 9.8
CVE-2024-38396 WRITEUP CRITICAL WRITEUP
iTerm2 3.5.0-3.5.1 - Remote Code Execution via Window Title Escape Sequence
An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.
CVSS 9.8
CVE-2026-41253 WRITEUP MEDIUM WRITEUP
iTerm2 < 3.6.9 - Remote Code Execution via DCS 2000p and OSC 135 Data
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.
CVSS 6.9
CVE-2023-46321 WRITEUP CRITICAL WRITEUP
iTerm2 <3.5.0beta12 - Path Traversal
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.
CVSS 9.8
CVE-2023-46322 WRITEUP CRITICAL WRITEUP
iTerm2 < 3.5.0beta12 - OS Command Injection via SSH URL Hostname
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period.
CVSS 9.8
CVE-2023-46300 WRITEUP CRITICAL WRITEUP
iTerm2 < 3.4.20 - Remote Code Execution via tmux Escape Sequence Mishandling
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.
CVSS 9.8
CVE-2023-46301 WRITEUP CRITICAL WRITEUP
iTerm2 < 3.4.20 - Remote Code Execution via Escape Sequence Mishandling
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
CVSS 9.8