{"id":"CVE-2025-22275","aliases":["EUVD-2025-2685","GHSA-p83h-g6jw-gh8f"],"status":"published","title":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive...","description":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00494,"percentile":0.42925,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-532"],"published":"2025-01-03T00:00:00Z","modified":"2026-10-28T02:30:45Z","products":[{"vendor":"iterm2","product":"iterm2"}],"references":[{"url":"https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog","tags":["Release Notes","web"]},{"url":"https://news.ycombinator.com/item?id=42579472","tags":["Issue Tracking","web"]},{"url":"https://gitlab.com/gnachman/iterm2/-/wikis/SSH-Integration-Information-Leak","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22275","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p83h-g6jw-gh8f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22275.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-22275","description":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.","status":"published","published":"2025-01-03T00:00:00Z","modified":"2025-01-03T14:58:54.733Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:28.943062Z"}],"euvd":[{"id":"EUVD-2025-2685","description":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.","status":"published","published":"2025-01-03T00:00:00Z","modified":"2025-01-03T14:58:54Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"updated_at":"2026-11-03T00:04:26.497295Z"}],"ghsa":[{"id":"GHSA-p83h-g6jw-gh8f","title":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive...","description":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.","status":"published","published":"2025-01-03T06:32:10Z","modified":"2025-01-03T09:30:47Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:59:21.358574Z"}],"nvd":[{"id":"CVE-2025-22275","description":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.","status":"published","published":"2025-01-03T05:15:08.243Z","modified":"2026-06-17T08:46:05.04Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:10:48.373347Z"}],"osv":[{"id":"CVE-2025-22275","description":"iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation.","status":"published","published":"2025-01-03T00:00:00Z","modified":"2026-10-28T02:30:45.693752209Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"critical"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:47.009967Z"}]}}