Iterm2 vulnerabilities

Products

• Iterm2 13

Newest

• iterm2 iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler,... CVE-2026-123014 Public exploit 8.7 HighNovember 5, 2026
• iterm2 In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC... CVE-2026-41253 6.9 MediumApril 18, 2026
• iterm2 iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive... CVE-2025-22275 9.3 CriticalJanuary 3, 2025
• gnachman iterm2 An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to... CVE-2024-38396 Public exploit 9.8 CriticalJune 16, 2024
• iterm2 In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus... CVE-2024-38395 9.8 CriticalJune 16, 2024
• iterm2 iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The... CVE-2023-46322 9.8 CriticalOctober 22, 2023
• iterm2 iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs.... CVE-2023-46321 9.8 CriticalOctober 22, 2023
• iterm2 iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain... CVE-2023-46301 9.8 CriticalOctober 22, 2023
• iterm2 iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain... CVE-2023-46300 9.8 CriticalOctober 22, 2023
• iterm2 iTerm2 before 3.4.18 mishandles a DECRQSS response. CVE-2022-45872 9.8 CriticalNovember 23, 2022
• iterm2 iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search... CVE-2019-19022 7.5 HighNovember 17, 2019
• iterm2 iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution CVE-2019-9535 9.8 CriticalOctober 9, 2019
• iterm2 iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A... CVE-2015-9231 7.5 HighSeptember 20, 2017