Arbitrary Code Injection Vulnerability in iTerm2 3.5.x

CVE-2024-38396

What is CVE-2024-38396?

A security issue has been identified in iTerm2 versions 3.5.x prior to 3.5.2, where unfiltered usage of an escape sequence for window title reporting can be exploited. This occurs in conjunction with the tmux integration feature, which is enabled by default, allowing attackers to inject arbitrary code into the terminal. This vulnerability poses a risk to users who utilize the tmux feature, exposing them to potential code execution attacks.

References