CVE-2019-9535

Summary

A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.

Affected Software

VendorProductVersion RangeStatus
iTerm2iTerm23.3.5 <= 3.3.5affected

Weaknesses

  • CWE-349: CWE-349

Workarounds

Update iTerm2 to version 3.3.6, which includes mitigations against exploitation of this vulnerability.

ADP Enrichment

CVE Program Container

Additional References

References