An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.
CVSS
No CVSS.
References
Configurations
History
20 Jun 2025, 18:05
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Iterm2
Iterm2 iterm2 |
|
| References | () http://www.openwall.com/lists/oss-security/2024/06/17/1 - Mailing List | |
| References | () https://gitlab.com/gnachman/iterm2/-/commit/fc60236a914d63fb70a5c632e211203a4f1bd4dd - Patch | |
| References | () https://vin01.github.io/piptagole/escape-sequences/iterm2/rce/2024/06/16/iterm2-rce-window-title-tmux-integration.html - Exploit | |
| References | () https://iterm2.com/downloads.html - Product | |
| CPE | cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:* |
17 Jun 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Jun 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-16 21:15
Updated : 2025-06-20 18:05
NVD link : CVE-2024-38396
Mitre link : CVE-2024-38396
JSON object : View
Products Affected
iterm2
- iterm2
CWE
No CWE.