CVE-2024-38395

CRITICAL

iTerm2 <3.5.2 - RCE

Title source: llm

Description

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

Exploits (1)

github SUSPICIOUS 19 stars
by vin01 · dockerfilepoc
https://github.com/vin01/poc-cve-2024-38396

References (5)

Scores

CVSS v3 9.8
EPSS 0.0946
EPSS Percentile 92.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
iterm2/iterm2 3.5.0 - 3.5.2
Published Jun 16, 2024
Tracked Since Feb 18, 2026