George Nachman

5 exploits Active since Oct 2023
CVE-2026-41253 WRITEUP MEDIUM WRITEUP
iTerm2 <=3.6.9 - Code Execution
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.
CVSS 6.9
CVE-2023-46321 WRITEUP CRITICAL WRITEUP
iTerm2 <3.5.0beta12 - Path Traversal
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.
CVSS 9.8
CVE-2023-46322 WRITEUP CRITICAL WRITEUP
iTerm2 <3.5.0beta12 - SSRF
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period.
CVSS 9.8
CVE-2023-46300 WRITEUP CRITICAL WRITEUP
iTerm2 <3.4.20 - Code Injection
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.
CVSS 9.8
CVE-2023-46301 WRITEUP CRITICAL WRITEUP
iTerm2 <3.4.20 - RCE
iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
CVSS 9.8