In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.
References
| Link | Resource |
|---|---|
| https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not | Exploit Third Party Advisory |
| https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 | Patch |
| https://iterm2.com/downloads.html | Product |
| https://news.ycombinator.com/item?id=47809190 | Issue Tracking |
Configurations
History
18 May 2026, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not - Exploit, Third Party Advisory | |
| References | () https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 - Patch | |
| References | () https://iterm2.com/downloads.html - Product | |
| References | () https://news.ycombinator.com/item?id=47809190 - Issue Tracking | |
| First Time |
Iterm2 iterm2
Iterm2 |
|
| CPE | cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:* |
18 Apr 2026, 06:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-18 06:16
Updated : 2026-05-18 16:50
NVD link : CVE-2026-41253
Mitre link : CVE-2026-41253
CVE.ORG link : CVE-2026-41253
JSON object : View
Products Affected
iterm2
- iterm2
CWE
CWE-829
Inclusion of Functionality from Untrusted Control Sphere