Code Execution Vulnerability in iTerm2 by Itsyourtime, Affecting Multiple Versions

CVE-2026-41253

What is CVE-2026-41253?

A vulnerability in iTerm2 allows for potential code execution when a .txt file is displayed. This issue arises under specific conditions where the working directory contains a maliciously named file, which exploits how the application handles the SSH conductor protocol. This exploitation can occur if the file name adheres to valid output expectations of the conductor encoding path, particularly those starting with 'ace/c+'. Users are encouraged to be vigilant when using iTerm2, especially with untrusted files and directories.

References